CVE-2026-18963: 
Java vulnerability analysis and mitigation

CVE-2026-18963 is a critical authentication bypass vulnerability in the reset-credentials flow of the keycloak-services component in Red Hat Build of Keycloak and upstream Keycloak. An unauthenticated remote attacker can force the password reset process for any user account — including administrative accounts — without clicking the required email verification link, enabling full account takeover by directly setting new credentials. The vulnerability was reported by James Paremain, disclosed on August 18, 2026, and affects org.keycloak:keycloak-services versions >= 26.0.0 < 26.4.15, >= 26.5.0 < 26.6.6, and >= 26.7.0 < 26.7.2. It carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat CVE, GitHub Advisory).

The root cause is improper state validation within the reset-credentials authentication flow (CWE-640: Weak Password Recovery Mechanism for Forgotten Password). The flow is designed to require the user to click an emailed action token before proceeding to the password update phase; however, by sending a specially crafted HTTP request to the reset-credentials endpoint, an attacker can manipulate the authentication session state to transition directly to the password update phase without possessing the required token. No privileges or user interaction are required — the attack is fully network-accessible and automatable. Public PoC exploit code and a forensic detection script targeting Keycloak's PostgreSQL database have been published (Red Hat Bugzilla, GitHub Advisory, Feedly).

Successful exploitation grants an unauthenticated attacker complete control over any targeted user account, including the ability to set arbitrary new credentials and lock out the legitimate owner. Because Keycloak serves as a central identity and access management (IAM) broker, compromise of administrative accounts can cascade to all applications and services relying on the affected realm for authentication, enabling broad lateral movement across federated systems. Confidentiality and integrity are both rated High, as attackers can access sensitive user data and modify credentials across the entire identity infrastructure; availability is not directly impacted by the vulnerability itself (Red Hat CVE, GitHub Advisory).

Public exploit code is available: github.com/atiilla/CVE-2026-18963-Exploit and github.com/alt3kx/CVE-2026-18963 (a tool named kc-resetforge) were published shortly after disclosure, and Nuclei detection templates were merged into ProjectDiscovery's template library. A forensic PostgreSQL script (kyos-public/keycloak-cve-2026-18963-hunt) was also released to detect past exploitation. The EPSS score is approximately 3.24% (87th percentile per GitHub Advisory), and the NVD SSVC assessment marks the vulnerability as automatable with no confirmed in-the-wild exploitation at time of analysis. The vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Keycloak or Red Hat Build of Keycloak instances using Shodan, Censys, or FOFA, targeting versions in the affected ranges (26.0.0–26.4.14, 26.5.0–26.6.5, 26.7.0–26.7.1). Confirm the "Forgot password" feature is enabled on the target realm.
2. Initiate password reset: Send an HTTP POST request to the Keycloak reset-credentials endpoint (e.g., /realms/{realm}/login-actions/reset-credentials) for a known or enumerated username, triggering the start of the reset flow and obtaining a session ID.
3. Bypass email verification: Instead of clicking the emailed action token, craft a follow-up HTTP request that manipulates the authentication session state — transitioning it directly to the password update phase without supplying the required token. This exploits the improper state validation in the flow.
4. Set new credentials: Submit a new password via the manipulated session, completing the account takeover without any interaction from the legitimate user.
5. Authenticate as victim: Log in to the Keycloak realm and any downstream applications using the newly set credentials, including administrative consoles if an admin account was targeted (Red Hat Bugzilla, GitHub Advisory).

• Network: Unusual HTTP POST requests to /realms/{realm}/login-actions/reset-credentials without a corresponding email link click event; multiple rapid reset-credentials requests for different usernames from the same source IP.
• Logs: Keycloak event logs showing RESET_PASSWORD or UPDATE_PASSWORD events without a preceding EXECUTE_ACTION_TOKEN event for the same session; password reset completions for accounts where the user did not initiate the process.
• Database: Forensic queries against the Keycloak PostgreSQL database (using tools like kyos-public/keycloak-cve-2026-18963-hunt) revealing authentication session state transitions that skip the email verification step; unexpected entries in USER_SESSION or AUTH_SESSION tables.
• Application: Unexpected account lockouts reported by legitimate users; admin accounts with recently changed passwords not initiated by the account owner; new OAuth tokens issued for accounts shortly after anomalous reset events (Feedly, Red Hat CVE).

Red Hat has released patched versions: Keycloak 26.4.15, 26.6.6, and 26.7.2 (upstream), with corresponding Red Hat Build of Keycloak container images (RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56524). Upgrading to a fixed version is the recommended remediation. As an immediate workaround if patching is not possible, disable the "Forgot password" feature in all realms via the RHBK administration console: Realm settings → Login → Forgot password → Off. Additionally, restrict network access to Keycloak services and monitor event logs for anomalous password reset activity (Red Hat CVE, Red Hat Errata RHSA-2026:56519, GitHub Advisory).

The vulnerability received significant media coverage, with The Hacker News, GBHackers, Heise, CyberSecurityNews, and WebProNews all publishing articles highlighting the critical severity and ease of exploitation. The Belgian Centre for Cybersecurity (CCB) issued a warning advisory, and national CERTs including Ireland's NCSC and Thailand's ThaiCERT published advisories urging immediate patching. Security researchers on Mastodon, Infosec.Exchange, and Reddit discussed the vulnerability extensively, with community sentiment emphasizing the high risk to organizations using Keycloak as a central IAM broker. Fortbridge and Insomnisec published detailed technical write-ups, and the alt3kx researcher released a public PoC tool (kc-resetforge) with a corresponding Medium article (The Hacker News, Heise, Fortbridge).