Full research report
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Executive assessment
The strongest evidence is Red Hat's advisory, which explicitly says an unauthenticated remote party can bypass the email-verification requirement in the reset-credentials flow and replace any user's credentials. Upstream Keycloak records tie the correction to 26.7.2, with maintenance fixes also associated with 26.4.15 and 26.6.6, while Red Hat's package table and errata identify corrected enterprise components and images. The GitHub advisory's unknown version ranges mean it is not safe to declare every earlier upstream Keycloak release vulnerable, although Red Hat advises assuming earlier packages in its listed minor streams are affected unless stated otherwise. No verified proof-of-concept, actor attribution, campaign evidence or CISA exploitation designation was found, so the immediate operational case rests on severe unauthenticated impact and identity-system exposure rather than confirmed in-the-wild activity.
What happened
CVE-2026-18963 was reported in Red Hat Bugzilla on 5 August 2026 and made public by Red Hat on 17 August. Red Hat issued fixes on 18 August, and upstream Keycloak subsequently included the correction in version 26.7.2. The flaw allows an unauthenticated remote party to bypass the email-verification stage of password recovery and set new credentials for a target account.
Affected scope
The affected component is keycloak-services in Red Hat build of Keycloak and the corresponding upstream reset-credentials flow. Red Hat provides fixes for its 26.4 and 26.6 streams through releases 26.4.15 and 26.6.6 and associated container and operator updates; upstream Keycloak 26.7.2 includes the fix. Red Hat advises treating earlier packages in listed minor streams as vulnerable unless explicitly marked otherwise, but no authoritative source defines the complete upstream affected-version range.
Technical assessment
Red Hat attributes the flaw to improper state validation in the reset-credentials authentication flow. A remote unauthenticated request can cause password recovery to proceed without successful use of the email action token, crossing the verification boundary that should prove control of the registered address. Successful exploitation permits credentials to be replaced for an arbitrary user and therefore creates direct account-takeover risk, including for privileged identities.
Recommended defensive actions
- Inventory all upstream Keycloak and Red Hat build of Keycloak deployments, including container images, operators and every configured realm.
- Upgrade upstream Keycloak to 26.7.2 or later, or apply the appropriate Red Hat 26.4.15 or 26.6.6 security update and corrected images.
- Disable the Forgot password function in every realm until patching is complete where an immediate upgrade is impossible.
- Hunt for unexpected password changes, reset-credentials requests and authentication sessions that reached credential-update activity without the expected email action-token completion.
- Review privileged accounts and recently reset identities for unauthorised credential changes, subsequent logins and access to relying applications.
- Validate the corrected password-recovery flow in a controlled environment before restoring the Forgot password function.
Uncertainties and evidence gaps
- No verified public proof-of-concept or confirmed exploitation was found, but absence from public records does not establish that exploitation has not occurred.
- The complete affected-version range for upstream Keycloak is not stated; the GitHub advisory explicitly marks affected and patched ranges as unknown despite the upstream release and issue records identifying fixed releases.
- Published sources do not establish whether every realm with password recovery enabled is exploitable or whether particular custom reset-flow configurations alter exposure.
- No independent assessment was found confirming that the released correction fully resolves every variant of the state-validation problem.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation or verified public proof-of-concept was identified as of 25 August 2026; the CVE was absent from CISA's 24 August Known Exploited Vulnerabilities catalogue.
The investigation began by testing the article's account-takeover, severity, remediation and exploitation claims against primary records. Red Hat, Keycloak and NVD consistently confirm an unauthenticated password-recovery verification bypass, while release and issue records identify the corrected release lines. Public-code and exploitation checks found no verified proof-of-concept, no known source code in the GitHub advisory and no CISA Known Exploited Vulnerabilities entry, supporting a technically critical but not publicly confirmed as exploited assessment.
- What precise event and claims did the supplied report describe?Reviewed the supplied article as an untrusted lead and extracted its timeline, CVE, account-takeover claim, fixed versions and claimed exploitation status.thehackernews.com ↗
The report attributed an unauthenticated password-reset bypass to CVE-2026-18963 and named Keycloak 26.7.2 and Red Hat releases 26.4.15 and 26.6.6 as fixes.
why This framed the focused investigation while leaving every security and remediation claim subject to primary-source verification.
- Does the vendor confirm the vulnerability, severity and mitigation?Read Red Hat's CVE advisory and affected-package records.access.redhat.com ↗
Red Hat confirms improper state validation in keycloak-services, unauthenticated remote exploitation without user interaction, CVSS 9.1, account takeover and temporary mitigation by disabling Forgot password in all realms.
why This establishes the core vulnerability and defensive guidance through the responsible vendor and CVE Numbering Authority.
- When was the issue first recorded and how was it characterised?Reviewed the linked Red Hat Bugzilla record.bugzilla.redhat.com ↗
Bug 2511595 was reported on 5 August 2026 and is titled as an unauthenticated account-takeover vulnerability caused by a reset-credentials flow bypass.
why The record supplies the earliest verified date found and corroborates that this is a focused vulnerability rather than a broader campaign.
- Did upstream Keycloak publish a corrected release?Reviewed the Keycloak 26.7.2 release record and its security-fix list.keycloak.org ↗
The upstream release lists issue 51833, CVE-2026-18963, among the security fixes in Keycloak 26.7.2.
why This directly supports 26.7.2 as the upstream corrected release, although it does not define the full affected range.
- What does the public advisory database add about versions and exploit code?Read GitHub Advisory Database entry GHSA-4gv3-mc9p-5wqc.github.com ↗
The entry confirms CVE-2026-18963, CVSS 9.1 and CWE-640 but marks both affected and patched versions unknown and lists no known source code.
why The unknown version fields constrain scope claims; the absence of known source code supports, but does not prove, the assessment that no verified public exploit was located.
- Does an independent government record corroborate the vulnerability?Reviewed the National Vulnerability Database record.nvd.nist.gov ↗
NVD reproduces the unauthenticated password-reset and account-takeover description, identifies Red Hat as the source, records CVSS 9.1 and CWE-640, and notes that enrichment remains pending.
why This provides independent-domain corroboration while warning that NVD has not completed its own enrichment.
- Which Red Hat product update was actually issued?Opened RHSA-2026:56519 and checked its synopsis, date and listed CVEs.access.redhat.com ↗
Red Hat issued a critical update on 18 August 2026 providing new Keycloak 26.4.15 and operator images and listing CVE-2026-18963 among the fixes.
why This verifies that deployable corrected Red Hat artefacts exist rather than relying only on a general CVE statement.
- Is current exploitation recognised by CISA?Checked CISA's complete Known Exploited Vulnerabilities catalogue version 2026.08.24 for the CVE identifier.cisa.gov ↗
CVE-2026-18963 was not present in the catalogue.
why Absence from the catalogue means CISA had not designated it as known exploited by 24 August, though this cannot establish non-exploitation.
- Which release lines does upstream associate with the fix?Reviewed upstream issue 51833 and its release labels and linked corrective change.github.com ↗
The closed issue is associated with releases 26.4.15, 26.6.6 and 26.7.2 and links merged pull request 51844.
why This reconciles the fixed releases stated in reporting with upstream maintenance records while avoiding an unsupported claim about all earlier upstream versions.
- Is there public technical evidence of the corrective change?Reviewed the merged Keycloak pull request associated with issue 51833.github.com ↗
Pull request 51844 explicitly closes CVE-2026-18963 and modifies reset-credentials flow state handling with regression coverage.
why The merged corrective change corroborates the state-validation diagnosis and confirms that the upstream fix was implemented, without constituting a verified exploit demonstration.
Research coverage
All 67 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok8 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| CISA KEVkev | ok1675 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok9 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5332 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 14 opened outside the registered collection
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Vendor & gov advisories5
Primary advisory describing the unauthenticated reset-credentials bypass, affected Red Hat streams and mitigation.
Upstream release record lists CVE-2026-18963 among the security fixes.
Red Hat security update providing corrected Keycloak 26.4.15 container images.
Government record corroborating the CVE description, CWE-640 classification and Red Hat CVSS 9.1 score.
Corroborates the vulnerability but leaves affected and patched version ranges unknown and lists no known source code.
Analysis & research4
Tracks the vulnerability as an unauthenticated account-takeover flaw reported on 5 August 2026.
Upstream issue links the fix to releases 26.4.15, 26.6.6 and 26.7.2.
Merged corrective change associated with CVE-2026-18963 and the reset-credentials flow.
Independent reporting that prompted verification against Red Hat, Keycloak, NVD and CISA records.