Critical Keycloak Flaw (CVE-2026-18963) Enables Full Account Takeover via Password Reset

Red Hat and the Keycloak project have shipped urgent patches for a flaw in the open-source identity and access management platform that allows unauthenticated remote attackers to take over any user account, including administrator profiles, by abusing the password reset flow. Tracked as CVE-2026-18963, the vulnerability carries a CVSS score of 9.1 from Red Hat, which serves as the CVE Numbering Authority. It has been classified as CWE-640, a weak password recovery mechanism for forgotten credentials. The root cause is described as improper state validation within the reset-credentials authentication flow. When an attacker sends a specially crafted request to the reset-credentials endpoint, the session transitions directly to the password update phase without ever requiring the action token that Keycloak normally delivers via email.

Administrators running upstream Keycloak should upgrade to version 26.7.2, released August 19, 2026, while organizations using the Red Hat build of Keycloak (RHBK) need to apply updates shipped for streams 26.4.15 and 26.6.6. Red Hat issued four errata on August 18, 2026 (RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524) covering both standalone server packages and container images. The company rated the issue Critical because exploitation demands no authentication and no user interaction. As of the disclosure date, there is no evidence of in-the-wild abuse and no verified public exploit, though the technical barrier to weaponization is low given that a single crafted HTTP request is sufficient. Security teams should treat the patching window as time-sensitive, particularly given the role Keycloak plays in federating access to downstream applications and services.

The flaw underscores the broader risk posed by identity-layer vulnerabilities. As Escape researcher Enzo Mongin noted in a separate July disclosure, an attacker who breaches Keycloak's perimeter rarely stops there because the platform gates entry to every protected resource behind it. Organizations should audit their identity infrastructure immediately, rotate any credentials that may have been exposed through Keycloak-mediated sessions, and review authentication logs for anomalous password reset activity. Admins can verify exposure by checking their current Keycloak version and consulting the official advisory. To strengthen defenses beyond patching, users and operators should run a password checker to ensure reset credentials meet complexity standards, validate their TLS configuration with an SSL/TLS checker to confirm transport security, and verify identity provider domains using a WHOIS lookup. Given that the GitHub advisory still lists affected and patched versions as unknown and the NVD record carries only Red Hat product references, defenders should rely directly on the vendor errata rather than third-party CVE summaries when planning remediation.