[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3fvaueQGJXa5jbkYvYU5dnVM1qUXfuJdLRYSAtR9SgA":3,"$fMlQGlfeUCuu0rQ82zQp7ATNItD_K691nvTbp6ldNyOQ":51},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":47,"created_at":48,"updated_at":49,"published_at":50},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","CVE-2026-18963 (CVSS 9.1) in the reset-credentials flow lets an attacker skip the email verification step and take over accounts.","A critical flaw in the reset-credentials flow of Red Hat Build of Keycloak lets a remote, unauthenticated attacker skip the email verification step and set a new password for any user. Fixed builds are available for the 26.4 and 26.6 streams and upstream Keycloak 26.7.2; disabling \"Forgot password\" is the interim workaround.",[10,11,12,13,14,15],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","# Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password\n\n*CVE-2026-18963 (CVSS 9.1) in the reset-credentials flow lets an attacker skip the email verification step and take over accounts.*\n\n**Tags:** `Keycloak` `Red Hat` `CVE-2026-18963` `CVSS 9.1` `account takeover` `password reset`\n\n> A critical flaw in the reset-credentials flow of Red Hat Build of Keycloak lets a remote, unauthenticated attacker skip the email verification step and set a new password for any user. Fixed builds are available for the 26.4 and 26.6 streams and upstream Keycloak 26.7.2; disabling \"Forgot password\" is the interim workaround.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS v3.1 | KEV | Exploitation |\n|---|---|---|---|\n| CVE-2026-18963 | 9.1 (Critical) | Not listed | No evidence as of 24 August 2026 |\n\n## What the flaw does\n\nCVE-2026-18963 is an improper state validation flaw in the reset-credentials flow of the `keycloak-services` component, the core identity and access management engine in Red Hat Build of Keycloak. According to the NVD description, an unauthenticated attacker can force the password reset process for any user without clicking the email verification link, and can then set new credentials directly, gaining full control of the target account.\n\nIn a normal Keycloak password reset, the server emails an action token to the user, and following that link proves the user controls the account before a new password can be set. CosmicBytez Labs reports that the attacker's request skips the email action-token step and reaches the password update phase, and that any account in any realm can be affected, including administrator accounts.\n\nThe flaw is rated CVSS v3.1 9.1 (Critical). CosmicBytez lists the attack as network-based, requiring no authentication and no user interaction.\n\n## Affected and fixed versions\n\n| Product | Affected | Fixed |\n|---|---|---|\n| Red Hat Build of Keycloak 26.4 | before 26.4.15-1 (`rhbk\u002Fkeycloak-operator-bundle`) and 26.4-23 (`rhbk\u002Fkeycloak-rhel9`, `rhbk\u002Fkeycloak-rhel9-operator`) | 26.4.15-1 \u002F 26.4-23 or later |\n| Red Hat Build of Keycloak 26.6 | before 26.6.6-1 (`rhbk\u002Fkeycloak-operator-bundle`) and 26.6-12 (`rhbk\u002Fkeycloak-rhel9`, `rhbk\u002Fkeycloak-rhel9-operator`) | 26.6.6-1 \u002F 26.6-12 or later |\n| Upstream Keycloak | before 26.7.2 | 26.7.2 (released 19 August 2026) |\n\nCosmicBytez notes that Keycloak 26.7.2 also fixes several other CVEs, including CVE-2026-15571, an account takeover through a predictable account-linking hash.\n\n## Workaround\n\nUntil patches are applied, Red Hat recommends disabling the \"Forgot password\" feature in every realm (Administration Console, Realm settings, Login, set Forgot password to Off), as reported by CosmicBytez. This also turns off legitimate self-service password recovery, so helpdesk teams should be warned first.\n\nCosmicBytez also recommends MFA on administrator accounts, reviewing logs for `reset-credentials` activity from before patching, and limiting access to the Keycloak management interface to trusted administrative networks.\n\n## Key points\n\n- CVE-2026-18963 is a critical (CVSS 9.1) flaw in the keycloak-services reset-credentials flow.\n- An unauthenticated attacker can skip email verification and set a new password for any user, including administrators.\n- Fixed in Red Hat Build of Keycloak 26.4.15-1 \u002F 26.4-23, 26.6.6-1 \u002F 26.6-12, and upstream Keycloak 26.7.2.\n- Interim workaround: turn off \"Forgot password\" in every realm.\n- No evidence of active exploitation as of 24 August 2026, and the CVE is not in CISA KEV.\n\n## Further reading & sources\n\n- [Red Hat Keycloak vulnerability CVE-2026-18963: find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fred-hat-keycloak) (runZero)\n- [Critical Keycloak Flaw Lets Attackers Reset Any Account Password Without Authentication](https:\u002F\u002Flabs.cosmicbytez.ca\u002Fnews\u002F2026-08-24-keycloak-password-reset-flaw) (CosmicBytez Labs)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a",{"cves":19,"timeline":35,"technologies":40},[20,29],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2026-15571",false,"\u002Fvulnerabilities\u002FCVE-2026-15571",7.3,0.0043,"Medium",46.32,"3.1",{"id":12,"kev":22,"poc":30,"url":31,"cvss":32,"epss":33,"risk_band":26,"risk_score":34,"cvss_version":28},true,"\u002Fvulnerabilities\u002FCVE-2026-18963",9.1,0.0468,58.75,[36],{"date":37,"event":38,"description":39},"2026-08-19","Release","Keycloak 26.7.2 released",[41,43,44,46],{"vendor":11,"product":42},"Keycloak 26.4",{"vendor":10,"product":10},{"vendor":11,"product":45},"Keycloak 26.6",{"vendor":11,"product":10},"vulnerability_disclosure","2026-09-30T12:09:12.456253+00:00","2026-10-16T12:27:59.010948+00:00",null,{"articles":52},[53,66,77,89],{"slug":54,"title":55,"summary":56,"tags":57,"hero_image_url":64,"story_type":47,"created_at":65},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[58,59,60,61,62,63],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","CISA KEV","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","2026-10-17T12:03:14.799873+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":75,"story_type":47,"created_at":76},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[71,72,62,73,74],"CVE-2026-18556","N-Able N-Central","RCE","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":87,"story_type":47,"created_at":88},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands","CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.",[82,83,73,84,85,86],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00",{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":98,"story_type":47,"created_at":99},"cisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild","Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild","Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, on 9 September 2026 to confirm active exploitation that its PSIRT became aware of in August. CISA added the CVE to its KEV catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.",[94,95,96,62,97],"Cisco","CVE-2026-20079","FMC","auth-bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild.png?v=e25c4c61c3","2026-09-12T07:10:09.180903+00:00"]