[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3fvaueQGJXa5jbkYvYU5dnVM1qUXfuJdLRYSAtR9SgA":3,"$fMlQGlfeUCuu0rQ82zQp7ATNItD_K691nvTbp6ldNyOQ":44},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":40,"created_at":41,"updated_at":42,"published_at":43},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","CVE-2026-18963 (CVSS 9.1) in the reset-credentials flow bypasses email verification to force full account takeover.","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[10,11,12,13,14,15],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","# Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password\n\n*CVE-2026-18963 (CVSS 9.1) in the reset-credentials flow bypasses email verification to force full account takeover.*\n\n**Tags:** `Keycloak` `Red Hat` `CVE-2026-18963` `CVSS 9.1` `account takeover` `password reset`\n\n> Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-18963 | 9.1 | 3.2% | — | — | 54.77 (Medium) |\n\n## Critical Keycloak Flaw Lets Attackers Reset Any Account Password Without Authentication\n\nRed Hat has disclosed a critical vulnerability in Keycloak, the open-source identity and access management platform, that allows an unauthenticated remote attacker to reset the password for any user account without completing the email verification step.\n\nThe flaw, tracked as CVE-2026-18963, is an improper state validation error in the `keycloak-services` component’s reset-credentials flow. It carries a CVSS v3.1 score of 9.1 and affects Red Hat Build of Keycloak 26.4 and 26.6. An attacker sends a crafted request to the reset-credentials endpoint that advances the authentication session’s state past the email verification step, bypassing the action token that normally proves account ownership. The result is full account takeover for any user in any realm, including administrator accounts.\n\n## How the Email Verification Bypass Works\n\nIn a standard Keycloak password reset, the server generates an action token and emails it to the user’s registered address. The user clicks the link, which proves they control the account, before they can set a new password.\n\nCVE-2026-18963 breaks that sequence. An attacker sends a specially crafted request directly to the reset-credentials endpoint in `keycloak-services`. The request advances the authentication session’s state past the email verification step, so the server never checks the action token. The attacker then proceeds to set a new password for the target account.\n\nBecause the state transition is forced, the attacker does not need to be authenticated or own the email. They can reset the password for any user in any realm, including administrator accounts, in a single network request.\n\n## Affected Versions and Patch Details\n\nRed Hat Build of Keycloak 26.4 is affected in versions prior to 26.4.15-1 for the `rhbk\u002Fkeycloak-operator-bundle` image and 26.4-23 for the `rhbk\u002Fkeycloak-rhel9` image. Keycloak 26.6 is also impacted.\n\nThe fix ships in Keycloak 26.7.2. Red Hat has backported the state validation check to the 26.4 and 26.6 branches, so the reset-credentials endpoint now rejects the state transition if the action token has not been verified.\n\n## Attack Characteristics and Severity\n\nThe vulnerability carries a CVSS v3.1 score of 9.1, placing it in the CRITICAL band. The vector is `AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H`, meaning the attack is network-based, requires no prior authentication, and needs no user interaction. The scope is unchanged, so the attacker operates in the same security context as the target.\n\nThe impact is a full account takeover. An unauthenticated attacker can reset the password for any user in any realm, including accounts with administrative privileges. No email access is required; the attacker simply forces the state transition past the email verification step that normally proves account ownership via the action token.\n\n## Key points\n\n- CVE-2026-18963 is a critical (CVSS 9.1) flaw in the keycloak-services reset-credentials flow.\n- Unauthenticated remote attacker can force the password reset state past email verification without the action token.\n- Exploitation allows full account takeover for any user in any realm, including admin accounts.\n- Affects Red Hat build of Keycloak 26.4 prior to 26.4.15-1 (operator-bundle) and 26.4-23 (keycloak-rhel9).\n- No active exploitation or public PoC as of August 24, 2026; not yet in CISA KEV.\n\n## Further reading & sources\n\n- [Red Hat Keycloak vulnerability CVE-2026-18963: find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fred-hat-keycloak) — RunZero\n- [Critical Keycloak Flaw Lets Attackers Reset Any Account Password Without Authentication | CosmicBytez Labs](https:\u002F\u002Flabs.cosmicbytez.ca\u002Fnews\u002F2026-08-24-keycloak-password-reset-flaw)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a",{"cves":19,"timeline":28,"technologies":33},[20],{"id":12,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},false,"\u002Fvulnerabilities\u002FCVE-2026-18963",9.1,0.0318,"Medium",54.77,"3.1",[29],{"date":30,"event":31,"description":32},"2026-08-19","Release","Keycloak 26.7.2 released",[34,35,37,38],{"vendor":11,"product":10},{"vendor":11,"product":36},"Keycloak 26.4",{"vendor":10,"product":10},{"vendor":11,"product":39},"Keycloak 26.6","vulnerability_disclosure","2026-09-30T12:09:12.456253+00:00","2026-10-16T12:27:59.010948+00:00",null,{"articles":45},[46,59,71,84],{"slug":47,"title":48,"summary":49,"tags":50,"hero_image_url":57,"story_type":40,"created_at":58},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[51,52,53,54,55,56],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":60,"title":61,"summary":62,"tags":63,"hero_image_url":69,"story_type":40,"created_at":70},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[64,53,65,66,67,68],"Head Mare","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","2026-09-22T12:04:22.141581+00:00",{"slug":72,"title":73,"summary":74,"tags":75,"hero_image_url":82,"story_type":40,"created_at":83},"fidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r","Fidelis Security Discloses wp2shell Attack Chain for Unauthenticated WordPress RCE","Fidelis Security has disclosed the wp2shell attack chain, a two-CVE exploit that lets unauthenticated attackers achieve remote code execution on WordPress Core via the REST API batch endpoint and a WP_Query SQL injection in the author__not_in parameter.",[76,77,78,79,80,81],"WordPress","wp2shell","CVE-2026-60137","CVE-2026-63030","REST API","SQL Injection","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r.png?v=b1c1aa3d09","2026-09-22T07:08:43.775939+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":94,"story_type":40,"created_at":95},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[89,90,91,92,93],"CVE-2026-18556","N-Able N-Central","CISA KEV","RCE","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00"]