Keycloak (Product): news timeline & CVEs

Siemens Industrial Edge Management

Siemens Industrial Edge Management has a critical unauthenticated password-reset flaw enabling remote account takeover.

CISA republished Siemens ProductCERT SSA-503852 for CVE-2026-18963, a weak password-recovery flaw in Industrial Edge Management. An unauthenticated remote attacker can complete a password reset without the email verification link and take over accounts. CVSS 3.1 is 9.1. Affected ranges are Cloud (all versions), Pro V1 from 1.14.9 before 1.15.20, Pro V2 from 2.2.0 before 2.2.2, and Virtual from 2.6.0 before 2.9.1. The defect is in the Keycloak reset-credentials flow; the advisory does not report exploitation.

CISA Advisoriesupdated Sep 24, 12:00 UTC · 2d agofirst Sep 22, 12:00 UTC · 4d agoVulnerability 5 sources CVE-2026-18963

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.

The Hacker NewsAug 24, 11:56 UTC · Aug 24, 2026Vulnerability CVE-2026-18963 CVE-2026-15571

Keycloak

Timeline2 articles

Related CVEsby mentions

Appears with

Siemens Industrial Edge Management

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account