Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Summary: Red Hat and the Keycloak project patched CVE-2026-18963, a 9.1-rated flaw in the open-source identity and access management server that lets an unauthenticated remote attacker take over any account, including administrative accounts, by forcing a password reset. Red Hat traced the root cause to improper state validation in the reset-credentials authentication flow, where a crafted request moves the session straight to the password update phase without the action token normally sent by email; fixed versions are Keycloak 26.7.2 (released August 19, 2026) and RHBK 26.4.15 and 26.6.6, with no evidence of exploitation and no verified public exploit as of August 24, 2026.
What's compelling: The flaw requires no user interaction and no email token, so any deployment with the forgotten-password feature enabled is a candidate for full takeover of every account behind it, and Red Hat's only stopgap is disabling that feature across every realm until you upgrade.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-15571 CVE-2026-18963
Related: ⚡ Weekly Recap: AI-Powered PLC Attacks, Git Lab Attacks, Stripe Key Leaks and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026