CVE-2026-107121

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, the system fails to strictly enforce an encrypted connection, which allows a fallback to unencrypted communication if the encryption request is tampered with. An attacker capable of intercepting network traffic can exploit this behavior to capture sensitive email credentials and message content in plain text.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.