CVE-2026-18963 Analysis: Critical Keycloak Password Reset Vulnerability Allows Unauthenticated Account Takeover

Executive Summary

A critical vulnerability, CVE-2026-18963, has been identified in Keycloak, a widely adopted open-source identity and access management platform. This flaw enables unauthenticated attackers to take over any account—including privileged administrative accounts—by circumventing the password reset email verification process. The vulnerability is rated 9.1 (Critical) on the CVSS v3.1 scale due to its low complexity, remote exploitability, and the potential for total account compromise. As of the time of writing, there is no evidence of exploitation in the wild, no public proof-of-concept exploit, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the risk profile is severe, and immediate action is strongly advised.

Threat Actor Profile

There is no public reporting or attribution of any Advanced Persistent Threat (APT) group or other threat actor exploiting CVE-2026-18963 as of the time of writing. No sector or country targeting has been observed or attributed in relation to this vulnerability.

Technical Analysis of Malware/TTPs

CVE-2026-18963 affects the keycloak-services component, which is central to the authentication and credential management workflow in Keycloak and the Red Hat Build of Keycloak (RHBK). The vulnerability arises from improper state validation in the reset-credentials authentication flow. Specifically, an attacker can craft a request to the reset-credentials endpoint, causing the authentication session to skip the email verification step and proceed directly to password update. The action token, which should be delivered via email and validated, is never required, allowing an attacker to reset the password for any user account without access to the user’s email.

The root cause is a logic flaw in the state management of the reset-credentials flow, classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). The attack vector is network-based, with no privileges or user interaction required. The scope is unchanged, but the impact on confidentiality and integrity is high, as attackers can gain full control over any account, including those with administrative privileges. Availability is not directly impacted.

The vulnerability is present in all Keycloak versions prior to 26.7.2 and in specific RHBK versions prior to the patched releases (see Affected Product Versions). The flaw is particularly dangerous in environments where Keycloak is used as a central authentication provider for multiple applications, as compromise of a single account can lead to lateral movement and broader organizational impact.

Exploitation in the Wild

As of the latest updates, there are no confirmed reports of exploitation in the wild for CVE-2026-18963. No public proof-of-concept exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. This means that, while the vulnerability is critical and easily exploitable, there is currently no evidence that threat actors are actively targeting it. Organizations should remain vigilant, as the publication of technical details and patches often precedes exploitation attempts.

Victimology and Targeting

There is no evidence of exploitation in the wild, and no specific sectors, organizations, or countries have been targeted as of the time of writing. All organizations using vulnerable versions of Keycloak or RHBK are at risk.

Mitigation and Countermeasures

Immediate mitigation is possible by disabling the "Forgot password" functionality across all realms. In the RHBK administration console, navigate to Realm settings, then Login, and set Forgot password to Off. This action must be performed for every realm in your deployment.

Permanent remediation requires upgrading to a fixed version. For upstream Keycloak, upgrade to version 26.7.2 or later. For RHBK, upgrade to operator bundle 26.4.15-1, 26.6.6-1, or later, and ensure all relevant container images are updated as per Red Hat’s advisories.

Organizations should also monitor authentication logs for unusual password reset activity, especially for privileged accounts, and investigate any password resets that do not correspond to legitimate user requests.

References

About Rescana

Rescana provides a comprehensive Third-Party Risk Management (TPRM) platform that empowers organizations to continuously monitor, assess, and mitigate cybersecurity risks across their vendor ecosystem. Our platform delivers actionable intelligence and automated workflows to help you stay ahead of emerging threats and regulatory requirements. We are happy to answer any questions at info@rescana.com.