Keycloak unauthenticated account takeover via reset-credentials flow bypass (github.com)

Interesting! Was just in the process of reading about and comparing all the different identity-and-access-management-and-SSO solutions out there.