CVE-2026-18963: 
Keycloak vulnerability analysis and mitigation

CVE-2026-18963 is a critical authentication bypass vulnerability in the reset-credentials flow of the keycloak-services component in Red Hat Build of Keycloak. It allows an unauthenticated remote attacker to bypass the email verification step during password recovery and directly set new credentials for any user account, resulting in full account takeover. The vulnerability was reported by James Paremain, disclosed on August 18, 2026, and affects Red Hat Build of Keycloak prior to versions 26.4.15 and 26.6.x prior to 26.6.12 (container images), as well as upstream Keycloak prior to 26.7.2. It carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat CVE, GitHub Advisory).

The root cause is improper state validation within the reset-credentials authentication flow (CWE-640: Weak Password Recovery Mechanism for Forgotten Password). Normally, Keycloak requires a user to click a verification link sent via email before advancing to the password update phase; however, by sending a specially crafted request to the reset-credentials endpoint, an attacker can manipulate the authentication session state to skip the email token validation step and transition directly to the credential update phase. No privileges, user interaction, or prior authentication are required — the attack is fully network-accessible and automatable (Red Hat CVE, Red Hat Bugzilla). A forensic detection script and a public exploit repository have been published on GitHub (GitHub - kyos-public, GitHub - atiilla).

Successful exploitation grants an unauthenticated attacker complete control over any targeted user account — including administrative accounts — by resetting their password without their knowledge or consent. This results in high confidentiality and integrity impact, as the attacker can access all data and resources accessible to the compromised account, modify configurations, and potentially pivot to other systems or services federated through Keycloak. Availability is not directly impacted by the vulnerability itself, though account lockouts or credential changes could disrupt legitimate user access (Red Hat CVE, Red Hat Bugzilla).

As of the time of disclosure, no confirmed in-the-wild exploitation has been reported, and no weaponized exploit kit has been identified; however, a public exploit repository (CVE-2026-18963-Exploit by atiilla) and a forensic detection script (keycloak-cve-2026-18963-hunt by kyos-public) are available on GitHub. The vulnerability is rated automatable by NVD SSVC analysis, meaning it can be exploited at scale without manual interaction. The EPSS score is approximately 0.39%, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Keycloak or Red Hat Build of Keycloak instances using tools like Shodan or Censys, targeting deployments with the "Forgot password" feature enabled and running versions prior to 26.4.15, 26.6.12, or 26.7.2.
2. Initiate password reset: Send a standard password reset request for a known or enumerated username to the Keycloak reset-credentials endpoint (e.g., /realms/{realm}/login-actions/reset-credentials).
3. Craft malicious session state request: Instead of clicking the email verification link, send a specially crafted HTTP request to the reset-credentials endpoint that manipulates the authentication session state, bypassing the action token validation step required by the email link.
4. Advance to credential update phase: The manipulated request causes the server to transition the session directly to the password update phase without verifying email ownership.
5. Set new credentials: Submit a new password for the target account. The server accepts the credential change, granting the attacker full control over the account — including administrative accounts — without any email interaction (Red Hat CVE, Red Hat Bugzilla).

• Network: Unusual or repeated HTTP POST requests to /realms/{realm}/login-actions/reset-credentials without corresponding email link click events; requests that skip the expected email verification step in the flow sequence.
• Logs: Keycloak server logs showing password reset completions for users who did not initiate or confirm a reset via email; multiple rapid password reset completions across different user accounts from the same source IP.
• Database: Unexpected PASSWORD_RESET or UPDATE_PASSWORD events in the Keycloak EVENT table without a preceding SEND_RESET_PASSWORD email event for the same session; anomalous session state transitions in the AUTHENTICATION_SESSION table (detectable via the kyos-public forensic script).
• Logs: Admin console audit logs showing credential changes for high-privilege accounts (e.g., realm admins) outside of normal business hours or from unexpected IP addresses.

Red Hat has released patched versions addressing this vulnerability: Red Hat Build of Keycloak 26.4.15 (RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56524) and 26.6.12 (RHSA-2026:56523), and upstream Keycloak 26.7.2. As an immediate workaround if patching is not possible, Red Hat recommends disabling the "Forgot password" functionality in all realms via the RHBK administration console: navigate to Realm settings → Login → Forgot password → Off and apply this to every realm. Upgrading to a fixed version as soon as possible is the strongly recommended long-term remediation (Red Hat CVE, RHSA-2026:56519, RHSA-2026:56520).

The vulnerability received significant media and community attention shortly after disclosure. The Hacker News published a dedicated article titled "Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account," and the story was widely shared on social media platforms including Mastodon, Bluesky, Reddit (r/SecOpsDaily), and LinkedIn. Security researchers published technical write-ups on dev.to, suriq.io, and threat-intelligence.redeyesecurity.com, and the Belgium Centre for Cybersecurity (CCB) issued a warning advisory. The Keycloak project published a release announcement for version 26.7.2 explicitly addressing this flaw. Community sentiment reflects high concern given the unauthenticated, zero-interaction nature of the attack and the central role Keycloak plays in identity management for many organizations (The Hacker News, CCB Belgium, Keycloak Release).