Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Critical vulnerability (CVE-2026-18963, CVSS 9.1) in Keycloak allows unauthenticated remote attackers to bypass password reset token validation and take over any user account, including admin accounts Root cause is improper state validation within the reset-credentials authentication flow, allowing attackers to skip the email action token requirement entirely Red Hat released patches for RHBK 26.4.15 and 26.6.6, with upstream Keycloak fixed in version 26.7.2; temporary mitigation involves disabl
Analysis
TL;DR
- Critical vulnerability (CVE-2026-18963, CVSS 9.1) in Keycloak allows unauthenticated remote attackers to bypass password reset token validation and take over any user account, including admin accounts
- Root cause is improper state validation within the reset-credentials authentication flow, allowing attackers to skip the email action token requirement entirely
- Red Hat released patches for RHBK 26.4.15 and 26.6.6, with upstream Keycloak fixed in version 26.7.2; temporary mitigation involves disabling the "Forgot password" feature across all realms
- This is part of a broader pattern of security issues in Keycloak, with 26.7.2 addressing eight CVEs and 26.7.1 fixing twelve CVEs in the preceding release
Why It Matters
This vulnerability directly impacts organizations relying on Keycloak as their identity and access management backbone, as successful exploitation grants complete account takeover without any user interaction or authentication. Given that Keycloak serves as a central authentication gateway for countless enterprise applications, compromising it can provide attackers with a foothold into all systems protected by that identity provider.
Technical Details
- Vulnerability: CVE-2026-18963, CWE-640 (weak password recovery mechanism), CVSS 9.1, classified as Critical by Red Hat acting as the CVE Numbering Authority
- Attack vector: An unauthenticated remote attacker sends a specially crafted request to the reset-credentials endpoint, causing the authentication session to transition directly to the password update phase without requiring the email-delivered action token
- Affected versions: Upstream Keycloak before 26.7.2; Red Hat Build of Keycloak (RHBK) 26.4 before operator bundle 26.4.15-1 and container images 26.4-23; RHBK 26.6 before operator bundle 26.6.6-1 and container images 26.6-12
- Mitigation: Disable the "Forgot password" functionality across all realms via Realm settings > Login > Forgot password in the RHBK administration console until patched
- Related fixes: Keycloak 26.7.2 also addresses CVE-2026-15571 (predictable account-linking hash enabling OIDC-based account takeover); 26.7.1 fixed twelve CVEs including SAML broker login bypass and role forgery via dynamic client registration
Industry Insight
- Organizations using Keycloak should prioritize patching immediately, especially those with the "Forgot password" feature enabled in any realm; the temporary mitigation of disabling this feature is a reasonable short-term stopgap for environments where password self-service is not critical
- The rapid succession of critical CVEs across consecutive Keycloak releases (twelve in 26.7.1, eight in 26.7.2) signals systemic security debt that warrants deeper architectural review of authentication flows, particularly around state management and token validation
- Identity and access management platforms are increasingly targeted as high-value attack surfaces; this incident reinforces the need for defense-in-depth strategies where compromising the IAM layer does not grant unrestricted access to all downstream systems.
Disclaimer: The above content is generated by AI and is for reference only.