CVE-2026-18963: Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-18 · updated 2026-10-23
Weakness: CWE-640

Description

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Affected products

Red Hat build of Keycloak 26.4: all versions — fixed in 26.4-23, 26.4.15-1, 26.6-12, 26.6.6-1
Red Hat Single Sign-On 7: all versions

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4-23, 26.4.15-1, 26.6-12, 26.6.6-1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18963 or the next vulnerability affects your stack