CVE-2026-18963
published 2026-08-18CVE-2026-18963: A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build…
PriorityP187critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
3.18%
87.3th percentile
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rhbk-keycloak-rhel9 | rhbk-keycloak-rhel9 | — | — |
| rhbk-openshift-rhel9 | rhbk-openshift-rhel9 | — | — |
| rhbk | keycloak-operator-bundle_26.4.15-1 | — | — |
| rhbk | keycloak-rhel9-operator_26.4-23 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vulncheck9.1CRITICAL
vendor_redhat9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak.
ghsa_unreviewed·2026-08-18
CVE-2026-18963 [CRITICAL] CWE-640 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak.
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
GHSA
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
ghsa·2026-08-18
CVE-2026-18963 [CRITICAL] CWE-640 Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
VulnCheck
Red Hat build_of_keycloak Weak Password Recovery Mechanism for Forgotten Password
vulncheck·2026·CVSS 9.1
CVE-2026-18963 [CRITICAL] Red Hat build_of_keycloak Weak Password Recovery Mechanism for Forgotten Password
Red Hat build_of_keycloak Weak Password Recovery Mechanism for Forgotten Password
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Affected: Red Hat build_of_keycloak
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://previdian.com/CVE-2026-18963; https://www.l
Red Hat
keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass
vendor_redhat·2026-08-17·CVSS 9.1
CVE-2026-18963 [CRITICAL] CWE-640 keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass
keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Critical, given that it can be exploited by an unauthenticated remote attacker without any user interaction. Successful exploitation allows an attacker
No detection rules found.
Nuclei
Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass
nuclei·CVSS 9.1
CVE-2026-18963 [CRITICAL] Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass
Keycloak ]*action="https?://[^/]+(/[^"]*)"'
matchers:
- type: status
status:
- 200
internal: true
- id: step-3
raw:
- |
POST {{replace(reset_form_action,"&","&")}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
tryAnotherWay=on
redirects: true
max-redirects: 3
extractors:
- type: regex
name: selector_form_action
internal: true
part: body
group: 1
regex:
- 'id="kc-select-credential-form"[^>]*action="https?://[^/]+(/[^"]*)"'
matchers:
- type: status
status:
- 200
internal: true
- id: step-4
raw:
- |
POST {{replace(selector_form_action,"&","&")}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username={{username}}
redirects: true
max-redirects: 3
extractors:
- type: regex
name: restart_path
internal: true
part: body
group: 1
Bugzilla
CVE-2026-18963 keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass
bugzilla·2026-08-05·CVSS 9.1
CVE-2026-18963 [CRITICAL] CVE-2026-18963 keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass
CVE-2026-18963 keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the Keycloak reset-credentials authentication flow. The vulnerability exists in the way the flow state is managed, allowing an unauthenticated remote attacker to bypass the email verification requirement. By sending a specially crafted request to the reset-credentials endpoint, an attacker can transition the authentication session directly to the password update phase without possessing the required action token typically sent via email. Successful exploitation allows an attacker to perform a complete account takeover of any user, including administrative accounts, by resetting their password.
Hackernews
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
blogs_hackernews·2026-08-24
CVE-2026-19478 ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet.
That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder than they actually are.
Plenty to clean up. Here’s the short version.
## ⚡ Threat of the Week
U.S. Warns of AI-Powered Attacks on Siemens PLCs — Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series program
Hackernews
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
blogs_hackernews·2026-08-24·CVSS 9.1
CVE-2026-18963 [CRITICAL] Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.
The vulnerability, assigned the CVE identifier CVE-2026-18963 , is rated 9.1 on the CVSS scoring system by Red Hat, which acts as the CVE Numbering Authority (CNA) for the flaw. It has been classified as a weak password recovery mechanism for a forgotten password (CWE-640).
U
https://access.redhat.com/errata/RHSA-2026:56519https://access.redhat.com/errata/RHSA-2026:56520https://access.redhat.com/errata/RHSA-2026:56523https://access.redhat.com/errata/RHSA-2026:56524https://access.redhat.com/security/cve/CVE-2026-18963https://bugzilla.redhat.com/show_bug.cgi?id=2511595https://cert-portal.siemens.com/productcert/html/ssa-503852.html
2026-08-18
Published
Exploited in the wild