Summary
What?
A critical vulnerability in Keycloak’s credential reset (reset-credentials) flow allows an unauthenticated attacker to take control of any user account, including administrator accounts.
How?
By bypassing the email verification step normally required to validate a password reset request.
Affected products:
Red Hat Build of Keycloak (RHBK): versions 26.4.x < 26.4.15 and 26.6.x < 26.6.6.
But also, and most importantly (missing from the CVE entry), open-source Keycloak: versions 26.0.0 through 26.7.1 (fixed in 26.7.2).
Why isn’t open-source Keycloak listed in the CVE?
Because the CVE was registered by Red Hat, not by the Keycloak team. The CVE therefore only mentions Red Hat products, even though the vulnerability also affects the open-source project.
Major consequence: Detection tools (such as Trivy, Grype, or vulnerability scanners) do not automatically detect the vulnerability on non-Red Hat Keycloak instances, because the CVE is associated with the Red Hat Build of Keycloak and not with the community version of Keycloak.
The Vulnerability: CVE-2026-18963 in Detail
Technical Description
The vulnerability resides in the credentials reset flow of the keycloak-services component, which is Keycloak’s central engine for authentication management.
The attack mechanism is as follows:
- An attacker sends a specially crafted request to the credentials reset endpoint;
- The Keycloak code does not properly validate the state and skips the email token verification step.
As a result, the attacker gains direct access to the password reset page without needing the email link. The attacker can then reset the password of any user whose login name they know (such as their email address).
The impact is clear: an unauthenticated attacker can take control of any user account and potentially escalate their privileges to administrator level by targeting an administrative account.
Affected Versions
The versions affected by the vulnerability depend on the branch:
- ≤ 25.x: not affected;
- 26.0–26.3: affected, with no fix planned;
- 26.4: affected; version 26.4.15 fixes the vulnerability for RHBK users only;
- 26.5: affected, and no fix planned;
- 26.6: affected; version 26.6.6 fixes the vulnerability for RHBK users only;
- 26.7: affected; version 26.7.2 fixes the vulnerability.
If you cannot update immediately, you can:
Disable the “Forgot Password” feature:
Go to the Keycloak administration console, then navigate to Realm Settings → Login → Forgot password → Off. Repeat this step for all realms.
This measure affects the user experience: users will no longer be able to reset their passwords via the standard flow.
Use a custom reset flow:
If you have a custom reset-credentials flow that does not contain reset-credential-email, you are generally not vulnerable.
Add additional authentication factors:
Configure a required authentication factor (OTP, WebAuthn) after the email step in the reset flow. This does not fix the vulnerability, but it limits the impact (the attacker will not be able to complete the reset without the second factor).
Proof of Concept (PoC) and Exploitation
The complexity of the attack and the prerequisites for exploiting it are reported to be low. No user interaction is required as long as an attacker has the user’s credentials.
As of the date of this writing (August 24, 2026), no exploit code has been made public. However, some individuals have been able to reproduce the vulnerability and confirm that it can be exploited in a real-world scenario.
Given Keycloak’s widespread use, particularly on the Internet, this vulnerability is expected to attract the attention of malicious actors. Therefore, the release of exploit code followed by widespread exploitation is likely.
Detection Criteria for Exploitation
According to discussions on GitHub, a possible attack signature is:
- An UPDATE_PASSWORD event without a preceding SEND_RESET_PASSWORD event within the last 24 hours;
- Example detection script: kyos-public/keycloak-cve-2026-18963-hunt.
The Red Hat Build and Community Dynamics
Keycloak is an open-source identity and access management (IAM) project, originally developed by Red Hat and subsequently released to the community in 2016. Since then, two versions have coexisted:
- Open-source Keycloak (community): maintained by a community of contributors;
- Red Hat Build of Keycloak (RHBK): a commercial version supported by Red Hat, based on the open-source code.
This distinction is important because there are two maintainers for the same product. Furthermore, Red Hat is a CVE Numbering Authority (CNA), which means the company can register CVEs for its products. When a vulnerability is discovered in code shared between open-source Keycloak and RHBK, Red Hat may choose to register the CVE under its own name, even if the vulnerability also affects the community version.
Thus, unless the CVE entry is enriched, Red Hat decides what the authority information is and, consequently, which products are reported as affected. If Red Hat fails to mention the community version—as is the case here—security tools that rely on the CVE program may not collect this information.
Without making any accusations against Red Hat, this omission raises questions about the relationship between Red Hat and the Keycloak community, as well as the processes in place to ensure that users of the community edition benefit from a level of security equivalent to that of the commercial version.
The consequence is clear: tools such as Trivy, Grype, or vulnerability scanners do not detect CVE-2026-18963 in the open-source Keycloak images. The vendors will certainly respond, but the time already lost cannot be recovered.
There is also a security advisory on GitHub regarding the community edition, but since it is marked as “unreviewed,” it is highly likely that it will not be taken into account.
Key Takeaways
CVE-2026-18963 is a critically severe vulnerability that should be addressed promptly in your information system to prevent potential widespread exploitation. It allows for account takeover without authentication.
It affects both the Red Hat Build of Keycloak and the open-source version of Keycloak, but the CVE only mentions the Red Hat version.
Not all scanners automatically detect the vulnerability in the open-source version of Keycloak, which creates a false sense of security.
Update as soon as possible:
- RHBK → 26.4.15 or 26.6.6;
- Open-source Keycloak → 26.7.2+.
If you cannot update: disable the “Forgot Password” feature or use a secure custom flow.