What Happened?
Due to a vulnerability[1] in the version of Keycloak Single Sign On (SSO) software run by SOTA, an unknown attacker (possibly using AI assistance) was able to use the ‘reset password’ function to gain access to 6 SOTA accounts.
Timeline
We believe from looking at the logs that the attacker first created a dummy account to verify that the vulnerability was exploitable, before beginning to attempt various usernames in an attempt to gain admin access to the environment. The usernames attempted were variations of “sota”, “sota-admin”, “admin” and SOTA MT member callsigns and names (such as “andy”, “andrew”, “vk3arr”, etc). Of the accounts compromised, only one pertained to a MT team member, and that particular account did not have administrator privileges on any system.
Once an account was compromised, it was used to rapidly attempt various methods of trying to view configuration files, all of which were unsuccessful, or attempts to trigger other exploits that might give elevated privileges, also unsuccessful.
This occurred around 11:00 UTC on 5th NOV 2026 across an approximately 1 hour window, and was discovered shortly afterwards. Full remediation occurred at approximately 23:30 UTC on 5th NOV 2026.
Response
Our initial response was to block the IP address of the attacker across our systems, allowing us time to investigate the degree of compromise. We then searched our logs to determine which accounts had been affected, and disabled them. Once that was done, we patched Keycloak to the latest version to address the vulnerability.
Emails have been sent to the affected users.
From our investigations, it appears that:
- No log data was tampered with.
- One new article was posted on a summit page with some crude language. This has been deleted.
- No passwords were compromised (only reset)
- No admin accounts were compromised.
Since the SOTA DB contains no truly sensitive data we do not foresee any further complications from this incident. However, as per normal security guidelines, we strongly recommend that any passwords used for SOTA are not used in other contexts. SOTA SSO also supports 2FA authenticators, so can be enabled on accounts that wish to do so.
If you have noticed any password reset emails from our SSO system where you did not request it, and have not received an email from the SOTA MT about this breach, please inform the SOTA MT via our contact form (at: Summits on the Air) to allow us to investigate.
Regards,
Andrew
VK3ARR
obo SOTA MT IT Group
[1] Critical Password Reset Vulnerability (CVE-2026-18963) (CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass · Issue #51833 · keycloak/keycloak · GitHub)
)