Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.
Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.
- Unauthenticated takeover of any account, including admins
- Fixed in Keycloak 26.7.2 and RHBK 26.4.15/26.6.6
- No exploitation evidence or verified public PoC yet
- Mitigation: disable Forgot Password across all realms
- Same release also fixed CVE-2026-15571 account-linking flaw
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15571 | Predictable-hash account-linking forgery in Keycloak enables full account takeover | 7.3 | <1% | ||
| CVE-2026-18963 | Unauthenticated Account Takeover via Password Reset Flow in Red Hat Build of Keycloak | 9.1 | 7% | PoC ×4 |
From the original article
3 min read at thehackernews.com
Swati Khandelwal Aug 24, 2026 Vulnerability / Identity Security Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963 , is rated 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.