Skip to content

Keycloak CVE-2026-18963: unauthenticated password-reset account takeover

Summary

Red Hat and the Keycloak project patched CVE-2026-18963 (CVSS 9.1 Critical, CWE-640 "weak password recovery mechanism for a forgotten password") in Keycloak 26.7.2, released August 19, 2026. An unauthenticated remote attacker can take over any user account, including administrative accounts, by forcing the reset-credentials flow into the password-update phase without the emailed action token — the root cause is improper state validation in the reset-credentials authentication flow: a specially crafted request to the reset-credentials endpoint transitions the session directly to the password update. As of August 24, 2026 there is no confirmed exploitation in the wild and no verified public exploit (per The Hacker News coverage), so this is a patch-now item, not an incident item.

Tags

Affected / fixed

  • Upstream Keycloak: fixed in 26.7.2 (2026-08-19).
  • Red Hat build of Keycloak (RHBK): unaffected from operator bundle 26.4.15-1 / images rhbk/keycloak-rhel9(-operator) 26.4-23; and operator bundle 26.6.6-1 / images 26.6-12. Four errata issued 2026-08-18: RHSA-2026:56519, 56520, 56523, 56524.
  • The GitHub advisory lists affected/patched versions as unknown at capture; the CVE record carries Red Hat product references only.

Mitigation (if immediate update is not possible)

  • Disable the "Forgot password" functionality in every realm — RHBK administration console: Realm settings → Login → Forgot password. Red Hat requires this in all realms and pairs it with an urgent upgrade.

Defender heuristics

  1. Inventory every Keycloak / RHBK instance (including containers and operator-managed deployments) and confirm the 26.7.2 / 26.4.15 / 26.6.6 baseline; unversioned "Keycloak in a pod" deployments are the usual gap.
  2. Treat reset-credential-flow state as a trust boundary: add alerts on reset-credentials endpoint traffic that completes without the corresponding email-issued action token (logins immediately following password-reset requests from new source IPs).
  3. Apply the forgot-password kill switch as a temporary control only where the password-recovery UX can absorb the outage — it is a mitigation, not a fix.
  4. Assume account-takeover impact: a successful reset against an admin account reaches "everything sitting behind it" (per Escape research on a separate Keycloak access-control flaw) — audit downstream service accounts, SPI/Client-ID secrets, and federation trusts tied to the identity server.

Assessment limits

  • No exploitation or public exploit has been confirmed as of August 24, 2026; Red Hat's severity rests on the unauthenticated, no-interaction attack vector.
  • Exact affected-version ranges beyond the RHBK errata are not fully established (GitHub advisory incomplete at capture).

Sources