Keycloak CVE-2026-18963

A critical security flaw in Keycloak allows attackers to take over any user account without a password. The vulnerability, tracked as CVE-2026-18963, has a CVSS score of 9.1 and affects all versions before 26.7.2.

Red Hat and the Keycloak project have released patches for the issue. The flaw lets an unauthenticated attacker reset any user's password by bypassing the email verification step. No user interaction is required.

If you use Keycloak for authentication, this affects you. Let me explain what is going on and what needs to be done.

What Is the Keycloak CVE-2026-18963 Vulnerability?

The Keycloak CVE-2026-18963 vulnerability is a weak password recovery mechanism. It lives in the reset-credentials authentication flow, the process Keycloak runs when someone forgets their password.

How the Vulnerability Works

The Keycloak CVE-2026-18963 vulnerability is all about bad state management in the password reset flow.

The Technical Issue

The flaw is in how the system tracks the password reset process. An attacker sends a specially crafted request to the reset-credentials endpoint. The system then jumps straight to the password update step. The email token that Keycloak is supposed to send is never required.

The Impact

Successful exploitation results in a complete account takeover of any user. This includes administrative accounts. No user interaction is required.

What Red Hat Said:

Red Hat assessed the Keycloak CVE-2026-18963 vulnerability as Critical. The root cause is "improper state validation within the reset-credentials authentication flow."

Affected Versions

Other Vulnerabilities Fixed

The Keycloak CVE-2026-18963 vulnerability was one of eight CVEs fixed in Keycloak 26.7.2.

CVE-2026-15571

A predictable account-linking hash that enables account takeover through a malicious OIDC client.

Keycloak 26.7.1 (August 5, 2026)

Fixed twelve CVEs, including:

• A SAML login bypass
• A role forgery issue

What to Do Right Now

1. Update to the Fixed Version

Upstream Keycloak:

• Update to version 26.7.2 immediately.

Red Hat build of Keycloak:

• 26.4 users: Update to 26.4.15 or later
• 26.6 users: Update to 26.6.6 or later

2. If You Can't Update

Red Hat has a temporary workaround:

• Turn off "Forgot password" in all realms
• Go to: Realm settings → Login → Forgot password → Off

Important: This must be applied to every realm. It's a temporary measure. Patch as soon as possible.

3. Monitor for Suspicious Activity

• Detect suspicious password resets
• Detect account changes
• Monitor admin logs for suspicious activity

Why This Matters

Identity management systems are prime targets. When someone breaks into Keycloak, they get access to everything behind it.

Why It Matters:

• Keycloak is widely used for authentication
• A compromise means access to all connected applications
• Unauthenticated account takeover is as bad as it gets

The Researcher's Warning:

Escape researcher Enzo Mongin put it bluntly: "An attacker who crosses one of the server's boundaries does not stop at Keycloak. They get into everything sitting behind it."

What We Don't Know

The Bottom Line

Keycloak has a critical flaw that lets attackers take over accounts. Patch now.

What You Need to Know:

• CVE-2026-18963: CVSS 9.1
• Unauthenticated password reset bypass
• Fixed in Keycloak 26.7.2
• Red Hat build fixed in 26.4.15 and 26.6.6
• Temporary workaround: disable "Forgot password"
• No evidence of exploitation yet

What You Need to Do:

• Update to the fixed version
• If you can't, disable "Forgot password"
• Monitor for suspicious activity

FAQ Section

What is the Keycloak CVE-2026-18963 vulnerability?

It's a critical flaw that lets unauthenticated attackers reset any user's password without the email token. CVSS score: 9.1.

Which versions are affected?

Upstream Keycloak before 26.7.2. Red Hat build before 26.4.15 and 26.6.6.

Is it being exploited?

No evidence of exploitation yet. No verified public exploit found.

What should I do?

Update to Keycloak 26.7.2 or RHBK 26.4.15/26.6.6. If you can't update, disable "Forgot password" in all realms.

What else was fixed?

Keycloak 26.7.2 also fixed CVE-2026-15571, a predictable account-linking hash.

Source: The Hacker News