Critical Keycloak Password Reset Vulnerability Exposes User Accounts
Security flaw in identity management server allows unauthenticated attackers to take over any account.
1Critical Keycloak Vulnerability
Red Hat and the Keycloak project have released patches addressing a critical security flaw in the open-source identity and access management server. Designated as CVE-2026-18963, this vulnerability enables unauthenticated remote attackers to take over any user account. Rated 9.1 on the CVSS scale, the flaw is classified as a weak password recovery mechanism (CWE-640). Red Hat identified the root cause as improper state validation within the reset-credentials authentication flow, which Keycloak executes when a user requests password recovery.
2Affected Versions and Patches
Upstream Keycloak users are advised to update to version 26.7.2, while Red Hat's Keycloak build (RHBK) customers should apply updates for versions 26.4.15 and 26.6.6. The patches were released on August 19, 2026. Red Hat issued four errata (RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524) on August 18 to address the vulnerability. These updates cover standalone server packages and container images for two RHBK streams. Univention stated on August 20 that their Keycloak deployments aren't affected as the forgotten-password feature isn't activated.
3Attack Scenario
The vulnerability stems from a flaw in state management during Keycloak's reset-credentials authentication flow. Attackers can send a specially crafted request to the reset endpoint, causing the authentication session to transition directly to the password update phase without requiring the usual email-sent action token. Successful exploitation results in complete account takeover of any user, including administrative accounts, by resetting their password. Researcher Enzo Mongin noted that breaching Keycloak's boundaries often gives attackers access to everything behind it, amplifying the potential impact.
4Temporary Mitigation
For deployments that can't immediately update, Red Hat recommends disabling the "Forgot password" functionality across all realms. In RHBK's admin console, this setting is found under Realm settings > Login > Forgot password. The company emphasizes this must be applied to every realm and urges customers to upgrade to patched versions promptly. While no evidence of exploitation exists as of August 24, 2026, the critical severity rating reflects the risk of unauthenticated remote attacks requiring no user interaction.
5Additional Security Fixes
CVE-2026-18963 was among eight CVEs addressed in Keycloak 26.7.2's release notes. The same update fixed CVE-2026-15571, a predictable account-linking hash enabling account takeover via malicious OIDC clients. Earlier, Keycloak 26.7.1 on August 5 resolved twelve CVEs, including a SAML identity-provider-initiated broker login bypassing link-only restrictions and a default client registration policy permitting role forgery. Red Hat credited James Paremain for reporting CVE-2026-18963, though discovery details remain undisclosed.
6Broader Security Implications
This incident underscores how vulnerabilities in identity management systems can have cascading consequences. Basic functions like password reset mechanisms, when flawed, can compromise entire system security. The case highlights the growing challenge of maintaining security as development velocity increases, with teams now shipping code 10-50x faster. AI's capability to chain vulnerabilities within minutes further exacerbates these risks, necessitating enhanced visibility, response protocols, and remediation roadmaps for enterprise security teams.
7Discovery and Reporting
Red Hat acknowledged James Paremain for reporting the flaw, though specifics about its discovery weren't shared. GitHub's advisory lists both affected and patched versions as unknown, while the CVE record contains only Red Hat product references. Initially, the CVE marked Red Hat Single Sign-On 7 as unaffected and Red Hat JBoss EAP Expansion Pack as affected, but subsequent revisions narrowed the product list. NVD's truncated display leaves the current status of both unclear, demonstrating challenges in vulnerability documentation.
8Enterprise Security Takeaways
This vulnerability exemplifies the critical need for robust identity and access management security. Organizations must not only apply patches promptly but also strengthen security visibility, response capabilities, and remediation strategies. The incident reinforces that fundamental authentication flows require rigorous security testing, especially as attackers increasingly exploit chained vulnerabilities. AI-powered security solutions may play a pivotal role in faster vulnerability detection and remediation, helping security teams keep pace with accelerated development cycles and sophisticated threats.
Original article: The Hacker News — Keycloak'ta Kritik Şifre Sıfırlama Açığı