Full Report
Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as
Analysis Summary
# Vulnerability: Keycloak Critical Account Takeover via Password Reset Bypass
## CVE Details
- **CVE ID:** CVE-2026-18963
- **CVSS Score:** 9.1 (Critical)
- **CWE:** CWE-640 (Weak Password Recovery Mechanism for Forgotten Password)
## Affected Systems
- **Products:** Keycloak (Upstream) and Red Hat Build of Keycloak (RHBK).
- **Versions:**
- Upstream Keycloak: Versions prior to 26.7.2.
- RHBK 26.4: Versions prior to 26.4.15.
- RHBK 26.6: Versions prior to 26.6.6.
- **Configurations:** Systems where the "Forgot password" functionality is enabled in the realm settings.
## Vulnerability Description
The flaw stems from "improper state validation" within the `reset-credentials` authentication flow. In a standard secure flow, Keycloak requires an action token sent via email to verify identity before allowing a password change. Due to this vulnerability, an attacker can send a specially crafted request to the `reset-credentials` endpoint that forces the authentication session to transition directly to the password update phase, bypassing the email token requirement entirely.
## Exploitation
- **Status:** Not currently known to be exploited in the wild; no verified public PoC available (as of August 24, 2026).
- **Complexity:** Low (No user interaction required).
- **Attack Vector:** Network (Remote unauthenticated).
## Impact
- **Confidentiality:** High (Total account access).
- **Integrity:** High (Ability to change credentials and user data).
- **Availability:** High (Ability to lock out legitimate users).
- **Note:** Successful exploitation allows for complete takeover of any user account, including those with administrative privileges.
## Remediation
### Patches
Users should upgrade to the following versions immediately:
- **Upstream Keycloak:** 26.7.2
- **Red Hat Build of Keycloak 26.4:** Operator bundle 26.4.15-1; Container images rhbk/keycloak-rhel9:26.4-23.
- **Red Hat build of Keycloak 26.6:** Operator bundle 26.6.6-1; Container images rhbk/keycloak-rhel9:26.6-12.
### Workarounds
If patching is not immediately possible:
- **Disable Forgot Password:** In the Keycloak Administration Console, navigate to **Realm Settings** > **Login** and toggle **"Forgot password"** to **OFF**. This must be performed for every configured realm.
## Detection
- **Indicators of Compromise:** Monitor logs for unusual transitions in the `reset-credentials` flow where the password is updated without a corresponding successful email token verification.
- **Detection methods:** Audit administrative account activity for unexpected password changes or credential resets originating from unknown IP addresses.
## References
- Red Hat CVE Advisory: hxxps://access[.]redhat[.]com/security/cve/CVE-2026-18963
- Red Hat Bugzilla: hxxps://bugzilla[.]redhat[.]com/show_bug[.]cgi?id=2511595
- Keycloak Security Page: hxxps://www[.]keycloak[.]org/security
- GitHub Advisory: hxxps://github[.]com/advisories/GHSA-4gv3-mc9p-5wqc