Authorization Flaw in Keycloak Services by Red Hat

CVE-2026-18963

What is CVE-2026-18963?

CVE-2026-18963 is a security vulnerability found in the Keycloak Services component of Red Hat's identity and access management system. Keycloak is designed to provide authentication and authorization services for applications, enabling users to access a single interface for managing their accounts securely. The vulnerability manifests within the reset-credentials flow, where an attacker can manipulate the process to reset any user’s password without possessing the necessary email verification link. This exploit allows unauthorized individuals to gain full control over target accounts by directly altering user credentials, posing a significant threat to organizations relying on Keycloak for secure user management.

Potential impact of CVE-2026-18963

1. Account Takeover: The primary risk associated with this vulnerability is the potential for unauthorized account takeover. Attackers can reset user passwords, granting them access to sensitive information and critical resources within the organization.

2. Data Breach: Successful exploitation may lead to data breaches, as attackers could access and exfiltrate confidential information stored in user accounts. This breach could have severe legal and financial implications for organizations, especially those handling sensitive personal or financial data.

3. Reputation Damage: Organizations affected by this vulnerability may face reputational harm as customers and stakeholders lose trust in their ability to secure user accounts. This loss of trust could result in decreased customer loyalty and harm to brand integrity in the broader market.

News Articles

Cybersecuritynews

CVE-2026-18963

Critical Red Hat Keycloak Flaw Lets Unauthenticated Attackers Take Over Any User Account

Red Hat disclosed a vulnerability in Red Hat Build of Keycloak that allow unauthenticated remote attackers to take over arbitrary user accounts.

2 weeks ago

Webpronews

CVE-2026-18963

Critical Keycloak Vulnerability (CVE-2026-18963) Enables Account Takeover via Password Reset Bypass

A critical vulnerability (CVE-2026-18963, CVSS 9.1) in Keycloak allows unauthenticated attackers to hijack the password reset process by bypassing state validation, potentially taking over any account including administrative ones. Organizations should urgently upgrade to version 26.7.2 or later.

2 weeks ago

The Hacker News

CVE-2026-18963

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Keycloak CVE-2026-18963 could let unauthenticated attackers skip the emailed action token and reset any user's password.

2 weeks ago

References