Vulnerability details
| CVE | CVSS v3.1 | KEV | Exploitation |
|---|---|---|---|
| CVE-2026-18963 | 9.1 (Critical) | Not listed | No evidence as of 24 August 2026 |
What the flaw does
CVE-2026-18963 is an improper state validation flaw in the reset-credentials flow of the keycloak-services component, the core identity and access management engine in Red Hat Build of Keycloak. According to the NVD description, an unauthenticated attacker can force the password reset process for any user without clicking the email verification link, and can then set new credentials directly, gaining full control of the target account.
In a normal Keycloak password reset, the server emails an action token to the user, and following that link proves the user controls the account before a new password can be set. CosmicBytez Labs reports that the attacker's request skips the email action-token step and reaches the password update phase, and that any account in any realm can be affected, including administrator accounts.
The flaw is rated CVSS v3.1 9.1 (Critical). CosmicBytez lists the attack as network-based, requiring no authentication and no user interaction.
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| Red Hat Build of Keycloak 26.4 | before 26.4.15-1 (rhbk/keycloak-operator-bundle) and 26.4-23 (rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator) |
26.4.15-1 / 26.4-23 or later |
| Red Hat Build of Keycloak 26.6 | before 26.6.6-1 (rhbk/keycloak-operator-bundle) and 26.6-12 (rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator) |
26.6.6-1 / 26.6-12 or later |
| Upstream Keycloak | before 26.7.2 | 26.7.2 (released 19 August 2026) |
CosmicBytez notes that Keycloak 26.7.2 also fixes several other CVEs, including CVE-2026-15571, an account takeover through a predictable account-linking hash.
Workaround
Until patches are applied, Red Hat recommends disabling the "Forgot password" feature in every realm (Administration Console, Realm settings, Login, set Forgot password to Off), as reported by CosmicBytez. This also turns off legitimate self-service password recovery, so helpdesk teams should be warned first.
CosmicBytez also recommends MFA on administrator accounts, reviewing logs for reset-credentials activity from before patching, and limiting access to the Keycloak management interface to trusted administrative networks.
Key points
- CVE-2026-18963 is a critical (CVSS 9.1) flaw in the keycloak-services reset-credentials flow.
- An unauthenticated attacker can skip email verification and set a new password for any user, including administrators.
- Fixed in Red Hat Build of Keycloak 26.4.15-1 / 26.4-23, 26.6.6-1 / 26.6-12, and upstream Keycloak 26.7.2.
- Interim workaround: turn off "Forgot password" in every realm.
- No evidence of active exploitation as of 24 August 2026, and the CVE is not in CISA KEV.