Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-18963 | 9.1 | 3.2% | — | — | 54.77 (Medium) |
Critical Keycloak Flaw Lets Attackers Reset Any Account Password Without Authentication
Red Hat has disclosed a critical vulnerability in Keycloak, the open-source identity and access management platform, that allows an unauthenticated remote attacker to reset the password for any user account without completing the email verification step.
The flaw, tracked as CVE-2026-18963, is an improper state validation error in the keycloak-services component’s reset-credentials flow. It carries a CVSS v3.1 score of 9.1 and affects Red Hat Build of Keycloak 26.4 and 26.6. An attacker sends a crafted request to the reset-credentials endpoint that advances the authentication session’s state past the email verification step, bypassing the action token that normally proves account ownership. The result is full account takeover for any user in any realm, including administrator accounts.
How the Email Verification Bypass Works
In a standard Keycloak password reset, the server generates an action token and emails it to the user’s registered address. The user clicks the link, which proves they control the account, before they can set a new password.
CVE-2026-18963 breaks that sequence. An attacker sends a specially crafted request directly to the reset-credentials endpoint in keycloak-services. The request advances the authentication session’s state past the email verification step, so the server never checks the action token. The attacker then proceeds to set a new password for the target account.
Because the state transition is forced, the attacker does not need to be authenticated or own the email. They can reset the password for any user in any realm, including administrator accounts, in a single network request.
Affected Versions and Patch Details
Red Hat Build of Keycloak 26.4 is affected in versions prior to 26.4.15-1 for the rhbk/keycloak-operator-bundle image and 26.4-23 for the rhbk/keycloak-rhel9 image. Keycloak 26.6 is also impacted.
The fix ships in Keycloak 26.7.2. Red Hat has backported the state validation check to the 26.4 and 26.6 branches, so the reset-credentials endpoint now rejects the state transition if the action token has not been verified.
Attack Characteristics and Severity
The vulnerability carries a CVSS v3.1 score of 9.1, placing it in the CRITICAL band. The vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning the attack is network-based, requires no prior authentication, and needs no user interaction. The scope is unchanged, so the attacker operates in the same security context as the target.
The impact is a full account takeover. An unauthenticated attacker can reset the password for any user in any realm, including accounts with administrative privileges. No email access is required; the attacker simply forces the state transition past the email verification step that normally proves account ownership via the action token.
Key points
- CVE-2026-18963 is a critical (CVSS 9.1) flaw in the keycloak-services reset-credentials flow.
- Unauthenticated remote attacker can force the password reset state past email verification without the action token.
- Exploitation allows full account takeover for any user in any realm, including admin accounts.
- Affects Red Hat build of Keycloak 26.4 prior to 26.4.15-1 (operator-bundle) and 26.4-23 (keycloak-rhel9).
- No active exploitation or public PoC as of August 24, 2026; not yet in CISA KEV.