CVE-2026-18963, rated 9.1 by Red Hat, allows an unauthenticated remote attacker to take over any Keycloak account by forcing a password reset — including administrative accounts, Red Hat warned.
How the reset-credentials flow can be abused
Red Hat says the root cause is "improper state validation within the reset-credentials authentication flow," the sequence Keycloak runs when a user requests password recovery. According to the company’s advisory, an attacker can send a specially crafted request to the reset-credentials endpoint. The authentication session then transitions directly to the password update phase and the action token that Keycloak normally sends via email is never required.
Successful exploitation "results in a complete account takeover of any user, including administrative accounts," by resetting their password. Red Hat has classified the issue as a weak password recovery mechanism for a forgotten password (CWE-640) and assigned it CVE-2026-18963.
Affected versions, published fixes, and errata
Upstream Keycloak was fixed in release 26.7.2, published August 19, 2026. Customers using the Red Hat build of Keycloak (RHBK) should apply fixes shipped for 26.4.15 and 26.6.6.
- Red Hat issued four errata on August 18, 2026: RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523 and RHSA-2026:56524.
- Fixed RHBK artifacts include operator bundle 26.4.15-1 and container images rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator image 26.4-23 for the 26.4 stream.
- For the 26.6 stream, fixes appear in operator bundle 26.6.6-1 and keycloak-rhel9 and operator containers 26.6-12.
- Upstream Keycloak packages are fixed in 26.7.2 (released August 19, 2026).
Red Hat, acting as the CVE Numbering Authority for the flaw, rated the vulnerability 9.1 on the CVSS scale.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRed Hat’s mitigation guidance and the advisory record
For deployments that cannot immediately update, Red Hat published a temporary mitigation: turn off the "Forgot password" functionality across all realms. In the RHBK administration console the setting sits under Realm settings → Login → Forgot password. Red Hat said the setting must be applied to every realm and emphasized that customers should upgrade to a fixed version as soon as possible.
The public advisory record is partly uneven: the GitHub advisory lists both the affected and the patched versions as unknown, and the CVE record carries only Red Hat product references. The initial CVE record listed Red Hat Single Sign-On 7 as unaffected and the Red Hat JBoss Enterprise Application Platform Expansion Pack as affected; a later revision narrowed the product list and NVD’s display truncates it, leaving the current status of those two products not established.
Related Keycloak fixes in releases around 26.7.2
CVE-2026-18963 was one of eight CVE identifiers listed as fixed in Keycloak 26.7.2. That same release also addressed CVE-2026-15571, described as a predictable account-linking hash that enables account takeover through a malicious OpenID Connect (OIDC) client.
Two weeks earlier, Keycloak 26.7.1 (August 5, 2026) shipped fixes for twelve CVEs, including a SAML identity‑provider‑initiated broker login that bypassed a link‑only restriction and a default dynamic client registration policy that allowed role forgery via user property mappers.
What this means for technologists, Red Hat customers, and platform operators
- Technologists and security teams: apply the published updates (upstream 26.7.2 or the RHBK fixes for 26.4.15 / 26.6.6) or, if immediate patching is impossible, follow Red Hat’s mitigation by disabling Forgot password on every realm via Realm settings → Login → Forgot password.
- Enterprises and Red Hat customers: verify which RHBK operator bundles and container images are in use and install the errata RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523 and RHSA-2026:56524 where applicable; confirm the mitigation setting has been applied to every realm if not yet patched.
- Platform operators of hosted Keycloak services: note that a successful exploit bypasses the email action token entirely and can yield full account takeover, so prioritize patches or the realm-level mitigation to prevent unauthenticated resets.
No evidence indicates the flaw has been exploited, and as of August 24, 2026 there is no verified public exploit. Red Hat credited James Paremain with reporting the flaw. Univention noted on August 20 that "Nubus is not affected by this issue" because the forgotten‑password feature is not activated in its Keycloak deployments. Security researcher Enzo Mongin, writing separately about a different Keycloak access-control flaw disclosed in July, warned that an attacker who crosses one of the server's boundaries "they get into everything sitting behind it."
One concrete technical question remains: whether every realm with the forgotten‑password feature enabled is exploitable, or only certain reset‑credentials flow configurations — the published sources do not state which scenarios are affected. That uncertainty, combined with the reported ability to reset any account password without the normal email action token, is why Red Hat has marked CVE-2026-18963 as Critical and issued immediate patches and mitigations.
