{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERTVDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in the authentication and credential recovery process may allow an unauthenticated attacker to bypass intended verification controls during password reset operations. By exploiting this weakness, an attacker could reset credentials for arbitrary user accounts and gain unauthorized access without possessing valid authentication credentials.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Successful exploitation could lead to unauthorized account takeover and access to application resources with the privileges of the compromised user. Depending on the affected account's permissions, this may result in unauthorized access to sensitive information, misuse of privileged functions, modification of system settings, or broader compromise of the affected environment.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "The vulnerability was remediated in the Building Cloud Service on August 26, and as the service is centrally managed and updated automatically, no customer action is required to apply the security fix. Customers are advised to review user account activity and verify that no passwords have been changed unexpectedly prior to remediation.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH & Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "WAGO PSIRT",
        "url": "https://www.wago.com/de-en/automation-technology/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO",
        "url": "https://certvde.com/de/advisories/vendor/wago/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-102: WAGO: Unauthorized Account Access via Credential Recovery Process - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-102"
      },
      {
        "category": "self",
        "summary": "VDE-2026-102: WAGO: Unauthorized Account Access via Credential Recovery Process - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-102.json"
      }
    ],
    "title": "WAGO: Unauthorized Account Access via Credential Recovery Process",
    "tracking": {
      "aliases": [
        "VDE-2026-102"
      ],
      "current_release_date": "2026-11-04T13:00:00.000Z",
      "generator": {
        "date": "2026-11-04T12:18:07.655Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-102",
      "initial_release_date": "2026-11-04T13:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-11-04T13:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "7.36.156",
                    "product": {
                      "name": "Wago Building Cloud Services 7.36.156",
                      "product_id": "CSAFPID-22001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:wago:building_cloud:7.36.156:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=7.19|<7.36.156",
                    "product": {
                      "name": "Wago Building Cloud Services 7.19<7.36.156",
                      "product_id": "CSAFPID-21001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:wago:building_cloud:*:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "Building Cloud Services"
              }
            ],
            "category": "product_name",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "WAGO"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18963",
      "cwe": {
        "id": "CWE-640",
        "name": "Weak Password Recovery Mechanism for Forgotten Password"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-22001"
        ],
        "known_affected": [
          "CSAFPID-21001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T10:00:00.000Z",
          "details": "The vulnerability was remediated in the Building Cloud Service on August 26, and as the service is centrally managed and updated automatically, no customer action is required to apply the security fix. Customers are advised to review user account activity and verify that no passwords have been changed unexpectedly prior to remediation.",
          "product_ids": [
            "CSAFPID-21001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.1,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.1,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-21001"
          ]
        }
      ],
      "title": "Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass"
    }
  ]
}