Keycloak CVE-2026-18963: Unauthenticated Password Reset Hands Over Any Account, Including Admins

Red Hat and the Keycloak project have patched a critical vulnerability, CVE-2026-18963, that allows an unauthenticated attacker to reset any account's password, including those of administrators, without needing an emailed action token or any user interaction. This flaw is caused by an improper state validation issue within the reset-credentials authentication flow used by Keycloak.

The bug enables an attacker to craft a request to the reset-credentials endpoint, advancing the authentication session directly to the password update phase without the necessary email token. As a result, the attacker gains full control over any account on the server, including administrative accounts, and any systems protected by Keycloak as the identity provider.

The vulnerability has been rated with a CVSS score of 9.1, indicating a high severity. To mitigate the risk, organizations running Keycloak or Red Hat builds of Keycloak with the forgotten-password feature enabled should upgrade to version 26.7.2 (released August 19, 2026) or Red Hat builds of Keycloak 26.4.15 and 26.6.6. As a temporary mitigation before upgrading, organizations can disable the Forgot password feature in all realms through the Keycloak administration console.

If immediate patching is not possible, this setting must be applied to every realm to prevent exploitation. The vulnerability affects any organization running Keycloak or a Red Hat build of Keycloak with the forgotten-password feature enabled and reachable through an internet-accessible login endpoint.