CVE-2026-112208

The Keycloak authentication server is vulnerable to an account takeover via a flaw in the Organization identity-first login flow. The root cause is a failure to properly clear a success flag when a user is removed from a session after switching to a registration or password reset path. An attacke...