Red Hat, Keycloak Patch CVE-2026-18963, a 9.1 Password-Reset Flaw Enabling Account Takeover
Updated
Updated · The Hacker News · Aug 24
Red Hat, Keycloak Patch CVE-2026-18963, a 9.1 Password-Reset Flaw Enabling Account Takeover
3 articles · Updated · The Hacker News · Aug 24
Summary
Keycloak 26.7.2 and Red Hat build updates 26.4.15 and 26.6.6 fix CVE-2026-18963, which lets an unauthenticated remote attacker reset any user's password and seize the account, including admin accounts.
Red Hat said improper state validation in the reset-credentials flow lets a crafted request jump straight to password update, bypassing the email action token normally required for recovery.
Red Hat rated the bug Critical at 9.1 CVSS, said no exploitation or verified public exploit is known as of Aug. 24, and advised customers who cannot patch immediately to disable "Forgot password" in every realm.
The flaw underscores Keycloak's central role in enterprise access control: a compromise can expose systems behind it, and the 26.7.2 release also fixed seven other CVEs, including another account-takeover issue.
Could a single password-reset flaw in Keycloak silently compromise every application in your enterprise network?
With rising state-validation failures, is centralized authentication like Keycloak becoming the ultimate single point of failure?
Defending Against CVE-2026-18963: Lessons from the August 2026 Keycloak 9.1 CVSS Identity Breach
Overview
In August 2026, security researcher James Paremain discovered a critical vulnerability (CVE-2026-18963) in Keycloak, which allowed attackers to bypass email verification and reset passwords for any user, including administrators. After Red Hat and the NVD published details, Red Hat quickly issued advisories and patches, while tools like Nessus added detection. The flaw was caused by two software defects that, when combined, let attackers gain full control over accounts and potentially compromise all applications trusting Keycloak. Organizations were urged to upgrade to fixed versions or temporarily disable the 'Forgot password' feature to block attacks, though this also prevented legitimate password resets.