password-reset

The Reset Link That Never Asked for Email

A Keycloak password reset flaw can bypass email verification. What the report confirms, what remains unknown, and what to do now.