Unauthenticated Account Takeover via Password Reset Flow in Red Hat Build of Keycloak
AI analysis
Red Hat Build of Keycloak contains a critical flaw (CVE-2026-18963) in the reset-credentials flow of the keycloak-services component, the core identity and access management engine (CWE-640, broken password recovery). An unauthenticated attacker with network access to the Keycloak server can trigger the password reset process for any user and bypass the required email verification link, directly setting new credentials for the target. This yields full account takeover of the victim user, including high impact to confidentiality and integrity, with no privileges, user interaction, or special conditions required. Any deployment of Red Hat Build of Keycloak is potentially affected; the affected version ranges are not specified in the available data, so defenders should consult the Red Hat advisory for fixed releases. No public proof of concept, CISA KEV listing, or confirmed in-the-wild exploitation is known yet, though EPSS assigns a 3.2% probability of exploitation within 30 days (87th percentile).
What to do: Identify all Red Hat Build of Keycloak deployments in your environment and upgrade to the fixed versions listed in the Red Hat advisory once published (specific fixed versions are not included in the available data). Until patching, restrict network exposure of Keycloak instances, and audit account/credential-change activity for unexpected password resets, since the flaw requires no authentication or user interaction. Monitor for suspicious password-reset email activity reported by users, which may indicate active probing or exploitation.
Affected
| Red Hat Build of Keycloak (keycloak-services component, reset-credentials flow) | — |
Estimated exposure
large≈10,000s of deployments (public internet scans have catalogued tens of thousands of exposed Keycloak instances; RHBK-specific install counts and user totals… — Public internet scans have repeatedly shown tens of thousands of exposed Keycloak servers, and Red Hat Build of Keycloak is the commercially supported build of that widely deployed open-source IAM platform, so the population of deployments…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.