Security advisory: Unauthenticated account takeover via reset-credentials flow bypass (Keycloak)
Published: August 31, 2026
CVE-2026-18963
Severity: Critical (CVSS 9.1)
Status: Patched — update immediately
Topics on this page:
Summary
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Vulnerability details
| Impact | Scope | Details |
|---|---|---|
| Gain privileges or assume identity | Access control | An attacker could gain unauthorized access to the system by retrieving legitimate user’s authentication credentials. |
| DoS: Resource consumption (other) | Availability | An attacker could deny service to legitimate system users by launching a brute force attack on the password recovery mechanism using user ids of legitimate users. |
| Other | Integrity, other | The system’s security functionality is turned against the system by the attacker. |
Impacted versions
Upstream Keycloak: all versions below 26.7.2. Safe version: 26.7.2 (released August 19, 2026).
Red Hat Build of Keycloak (RHBK):
- stream 26.4: safe from 26.4.15-1 (RHSA-2026:56519)
- stream 26.6: safe from 26.6.6-1 (RHSA-2026:56523)
Keycloak 26.7.2 patches eight CVEs in total, including CVE-2026-15571, a vulnerability in account linking via hash.
Recommendations
- Update to Keycloak 26.7.2 or the appropriate RHBK version. The version appears in the footer of the admin console. You can also check via CLI (/opt/keycloak/bin/kc.sh –version) or API (GET /auth/realms/master, check keycloak-version field in JSON response)
- If you can’t update right now: Disable “Forgot password” across all realms. Admin console → Realm settings → Login tab → Forgot password → off. This removes the attack vector but takes self-service password reset away from your users, so treat it as a stopgap.
Support
As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.
