A critical security vulnerability (CVE-2026-18963) has been discovered in Keycloak, the open-source identity and access management server maintained by Red Hat. The flaw carries a CVSS score of 9.1 and allows unauthenticated remote attackers to take over any user account by forcing a password reset. Red Hat and the Keycloak project have released patches to address the issue. The vulnerability poses a significant risk to organizations relying on Keycloak for authentication and authorization. Users are strongly advised to apply the available patches immediately to prevent potential account compromise.
CVE-2026-18963 is a critical (CVSS 9.1) vulnerability in Keycloak's reset-credentials authentication flow, classified as CWE-640 (weak password recovery mechanism for forgotten password). The root cause is improper state validation within the reset-credentials authentication flow. An unauthenticated remote attacker can send a specially crafted request to the reset-credentials endpoint, causing the authentication session to transition directly to the password update phase without requiring the action token normally sent via email. This allows complete account takeover of any user, including administrative accounts, without any user interaction. The same Keycloak 26.7.2 release also fixed CVE-2026-15571, a predictable account-linking hash enabling account takeover through a malicious OIDC client. Keycloak 26.7.1 (August 5, 2026) addressed twelve CVEs including a SAML identity-provider-initiated broker login that bypassed a link-only restriction and a default dynamic client registration policy that allowed role forgery via user property mappers. No public exploit has been confirmed as of August 24, 2026.
1. Update upstream Keycloak to version 26.7.2 (released August 19, 2026). 2. Update Red Hat build of Keycloak (RHBK) 26.4 to operator bundle 26.4.15-1 or container images 26.4-23 or later. 3. Update Red Hat build of Keycloak (RHBK) 26.6 to operator bundle 26.6.6-1 or container images 26.6-12 or later. 4. Apply Red Hat errata RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524. 5. For deployments that cannot be updated immediately, disable the 'Forgot password' functionality across ALL realms via the RHBK administration console under Realm settings > Login > Forgot password. This setting must be applied to every realm individually. 6. Monitor for any unauthorized password reset attempts or account takeover activity, especially on administrative accounts.
