Keycloak flaw lets unauthorized password resets

Unauthenticated attackers could have forced password resets on any Keycloak account, potentially seizing control of administrative accounts, according to advisories from Red Hat and the Keycloak project. The flaw, tracked as CVE-2026-18963, stems from a weakness in the server's password recovery flow and has been rated critical. Patches are now available for upstream Keycloak and Red Hat's supported builds.

Critical flaw in password reset flow

The vulnerability is rated 9.1 on the CVSS scale by Red Hat, which assigned the CVE ID. It is classified under CWE-640, a weak password recovery mechanism for a forgotten password. The root cause, as Red Hat stated in its CVE advisory, is "improper state validation within the reset-credentials authentication flow," the sequence executed when a user requests password recovery.

The flaw lies in how the flow's state is managed, according to the Red Hat bug report. By sending a specially crafted request to the reset-credentials endpoint, an attacker can cause the authentication session to transition directly to the password update phase, bypassing the need for the action token that is normally sent via email. Successful exploitation results in complete account takeover of any user, including administrative accounts, by resetting their password.

Critical severity, no known exploits

Red Hat assessed the severity as Critical because an unauthenticated remote attacker can exploit the flaw without any user interaction. However, there is no evidence that the flaw has been exploited, and no verified public exploit has been located as of August 24, 2026.

The vulnerability affects both upstream Keycloak and Red Hat's build of Keycloak (RHBK). Users of upstream Keycloak are advised to update to version 26.7.2, released August 19, 2026. RHBK customers should apply the updates shipped for 26.4.15 and 26.6.6.

Patches and affected versions

Red Hat issued four errata on August 18, 2026 (RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523 and RHSA-2026:56524), covering the standalone server packages and the container images for two RHBK streams. The fixed versions are:

• Red Hat build of Keycloak 26.4 is unaffected from operator bundle 26.4.15-1, and from the rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator images 26.4-23
• Red Hat build of Keycloak 26.6 is unaffected from operator bundle 26.6.6-1 and from the keycloak-rhel9 and operator containers 26.6-12
• Upstream Keycloak is fixed in 26.7.2

The GitHub advisory for the flaw lists both the affected and the patched versions as unknown, and the CVE record carries only Red Hat product references. The initial CVE record listed Red Hat Single Sign-On 7 as unaffected and the Red Hat JBoss Enterprise Application Platform Expansion Pack as affected. A later revision narrowed the product list, and NVD's display truncates it, so the current status of both is not established.

Mitigation and workarounds

For deployments that cannot be updated immediately, Red Hat has published a temporary mitigation: turn off the "Forgot password" functionality across all realms. In the RHBK administration console, the setting sits under Realm settings, then Login, then Forgot password. Red Hat said the setting must be applied to every realm and that customers should upgrade to a fixed version as soon as possible.

This is not the first time Keycloak security has come under scrutiny. Escape researcher Enzo Mongin, writing about a separate Keycloak access-control flaw he disclosed in July, said an attacker who crosses one of the server's boundaries does not stop at Keycloak, and that "they get into everything sitting behind it."

Other fixes in the same release

CVE-2026-18963 was one of eight CVE identifiers listed as fixed in the Keycloak 26.7.2 release notes. The same release addressed CVE-2026-15571, a predictable account-linking hash that enables account takeover through a malicious OpenID Connect (OIDC) client.

Two weeks earlier, on August 5, 2026, Keycloak 26.7.1 shipped fixes for twelve CVEs, including a SAML identity-provider-initiated broker login that bypassed a link-only restriction and a default dynamic client registration policy that allowed role forgery via user property mappers.

Other vendors respond

Univention said in a post published August 20 that "Nubus is not affected by this issue" because the forgotten-password feature is not activated in its Keycloak deployments. Red Hat credited James Paremain with reporting the flaw.

Why it matters

This flaw sits at the identity layer, the gatekeeper to everything behind it. For organizations running Keycloak as their single sign-on hub, a full account takeover could cascade into broader system compromise, especially if administrative accounts are seized. The lack of confirmed exploits may offer some breathing room, but the absence of public exploit details also means defenders can't assume they're safe. The key takeaway: apply the patches or disable the forgotten-password feature immediately, and treat any password reset activity as potentially suspect until the update is in place. This incident also underscores the importance of scrutinizing identity flows for state validation issues, as even a small oversight can have outsized consequences.