Red Hat, alongside the Keycloak project, has issued a security patch to fix a critical vulnerability in their open-source identity and access management server. This flaw, identified as CVE-2026-18963, permits unauthenticated attackers to take control of any user account by exploiting a password reset mechanism.
Details of the Security Flaw
Rated 9.1 on the CVSS scale, the vulnerability is classified under CWE-640 due to its weak password recovery processes. Users of Keycloak are urged to upgrade to version 26.7.2, released on August 19, 2026. Red Hat customers using Keycloak should update to versions 26.4.15 and 26.6.6 as appropriate.
Although the vulnerability has not been exploited, and no public exploit exists, Red Hat warns of its critical nature. The flaw arises from improper validation during the reset-credentials authentication flow, enabling remote attackers to bypass user interaction requirements.
Exploitation Mechanics
The defect allows attackers to send a specially crafted request to Keycloak’s reset-credentials endpoint. This request moves the authentication session to the password update phase without the usual action token, which is typically emailed to users. Successful exploitation can lead to full account takeovers, even of administrative accounts.
Security researcher Enzo Mongin notes that once an attacker breaches Keycloak, they potentially access other systems integrated with it. Red Hat has released errata that address these issues, affecting standalone server packages and container images.
Mitigation and Future Precautions
For systems that cannot be immediately updated, Red Hat advises disabling the “Forgot password” feature across all realms. This setting can be found in the RHBK administration console under Realm settings, then Login.
Beyond CVE-2026-18963, Keycloak’s 26.7.2 release also fixes seven other vulnerabilities, including a predictable hash flaw in account linking. Previous updates addressed significant issues like SAML identity-provider-initiated broker login bypasses.
Univention reports that its Keycloak deployments are unaffected as they do not utilize the vulnerable password recovery feature. The complete resolution of the flaw remains unclear, with questions about specific configurations at risk still unanswered.
