Keycloak CVE-2026-18963 Account Takeover Flaw

Executive Summary

A critical vulnerability tracked as CVE-2026-18963 has been discovered in Keycloak, a popular open-source Identity and Access Management (IAM) solution developed by Red Hat. The flaw, which carries a CVSS v3.1 score of 9.1, allows an unauthenticated remote attacker to bypass the email verification step in the password reset flow. This enables a complete account takeover of any user, including those with administrative privileges, simply by knowing their username or email address. Red Hat and the Keycloak project have released patches to address the vulnerability and strongly advise all users to update their instances immediately. As of late August 2026, there are no reports of this vulnerability being exploited in the wild.

Vulnerability Details

The vulnerability is classified as a 'Weak Password Recovery Mechanism for Forgotten Password' (CWE-640) and exists within Keycloak's reset-credentials authentication flow. The core of the issue is an improper state validation during the password reset process. An attacker can craft a specific HTTP request to the reset-credentials endpoint that manipulates the authentication session state. This manipulation tricks the server into skipping the step where it sends a password reset link to the legitimate user's email address. Instead, the server proceeds directly to the password update form, allowing the attacker to set a new password for the targeted account.

The attack requires no prior authentication and no user interaction. The only prerequisite is for the attacker to know the username or email address of a valid account on the target Keycloak server.

Affected Systems

The vulnerability affects the following products and versions:

• Upstream Keycloak: All versions prior to 26.7.2
• Red Hat build of Keycloak (RHBK):
  • Versions prior to 26.4.15
  • Versions prior to 26.6.6

Organizations using Keycloak for single sign-on (SSO), federation, and user management are directly impacted. Given Keycloak's widespread adoption, a large number of applications and services could be at risk if their underlying IAM platform is not patched.

Exploitation Status

As of August 24, 2026, there was no evidence that CVE-2026-18963 had been exploited in the wild. No public proof-of-concept (PoC) exploit code had been verified, though the technical details are sufficient for knowledgeable attackers to develop one. The lack of active exploitation provides a critical window for defenders to apply patches before attacks become widespread.

Impact Assessment

The impact of this vulnerability is critical. Successful exploitation grants an attacker complete control over any user account on a vulnerable Keycloak server. If an administrative account is targeted, the attacker gains full control over the IAM platform itself. This could lead to:

• Creation of rogue administrative accounts.
• Unauthorized access to all applications integrated with Keycloak.
• Widespread data breaches as the attacker impersonates legitimate users.
• Disruption of services that rely on Keycloak for authentication.

Because Keycloak is often the central hub for an organization's identity management, a compromise can have devastating and far-reaching consequences.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

Security teams should focus on both identifying vulnerable systems and detecting exploitation attempts.

1. Vulnerability Scanning: Use asset inventory systems or vulnerability scanners to identify all instances of Keycloak and check their version numbers against the patched versions.
2. Log Analysis: Implement detection rules in your SIEM to look for the specific attack pattern. A rule could trigger an alert if a reset-credentials flow completes the password update step without a corresponding token verification step in the same session. This requires detailed analysis of Keycloak event logs.
3. Behavioral Analysis: Monitor for anomalous account behavior, such as an administrator account logging in from an unfamiliar IP address or performing unusual actions immediately after a password reset.

Remediation Steps

The primary remediation is to apply the patches provided by Red Hat and the Keycloak community.

1. Upgrade Immediately:
   • Upstream Keycloak users should upgrade to version 26.7.2 or later.
   • RHBK users should apply the updates to reach version 26.4.15 or 26.6.6 (or later).
2. Review Logs: After patching, review authentication and event logs for any signs of suspicious password reset activity that may have occurred before the patch was applied.
3. Force Password Resets (Optional): For high-security environments, consider forcing a password reset for all privileged users after patching to invalidate any credentials that may have been compromised unknowingly.
4. Workaround (If patching is not possible): As a temporary measure, organizations could disable the password reset feature entirely, but this has significant usability drawbacks. Patching is the only recommended permanent solution.