CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
CVE-2026-18963 is a critical vulnerability (CVSS 9.1) in Red Hat Build Of Keycloak 26.4, published August 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.09%, the 94th percentile. Fixed in org.keycloak:keycloak-services 26.4.15.
- Severity
- 9.1 CriticalCVSS 3.1, CVE List
- Exploit chance
- 8.09%EPSS, 94th percentile
- Exploitation
- None known19 public exploits
- Fixed in
26.4.15org.keycloak:keycloak-services +12 more
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Discussion
Affected products
- red hat build of keycloak 26.4
- red hat build of keycloak 26.4.15
- red hat build of keycloak 26.6
- red hat build of keycloak 26.6.6
- red hat jboss enterprise application platform expansion pack
- red hat single sign-on 7
- red hat single sign-on 7.6 for rhel 7
- red hat single sign-on 7.6 for rhel 8
- red hat single sign-on 7.6 for rhel 9
- red hat rhel-8 based middleware containers
- siemens industrial edge management cloud
- siemens industrial edge management pro v1
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven | 26.0.0 up to 26.4.15 | 26.4.15 |
org.keycloak:keycloak-servicesMaven | 26.5.0 up to 26.6.6 | 26.6.6 |
org.keycloak:keycloak-servicesMaven | 26.7.0 up to 26.7.2 | 26.7.2 |
keycloakBitnami | before 26.7.2 | 26.7.2 |
org.keycloak:keycloak-servicesMaven | 26.0.0 up to 26.4.15, plus listed versions 26.0.126.0.226.0.326.0.426.0.5 Show 29 moreShow less26.0.626.0.726.0.826.1.026.1.126.1.226.1.326.1.426.1.526.2.026.2.126.2.226.2.326.2.426.2.526.3.026.3.126.3.226.3.326.3.426.3.526.4.026.4.126.4.226.4.326.4.426.4.526.4.626.4.7 | 26.4.15 |
org.keycloak:keycloak-servicesMaven | 26.5.0 up to 26.6.6, plus listed versions 26.5.126.5.226.5.326.5.426.5.5 Show 7 moreShow less26.5.626.5.726.6.026.6.126.6.226.6.326.6.4 | 26.6.6 |
org.keycloak:keycloak-servicesMaven | 26.7.0 up to 26.7.2, plus listed versions 26.7.1 | 26.7.2 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 | before 0:18.0.21-1.redhat_00001.1.el7sso | 0:18.0.21-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 | before 0:18.0.21-1.redhat_00001.1.el7sso | 0:18.0.21-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 | before 0:18.0.21-1.redhat_00001.1.el8sso | 0:18.0.21-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 | before 0:18.0.21-1.redhat_00001.1.el8sso | 0:18.0.21-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 | before 0:18.0.21-1.redhat_00001.1.el9sso | 0:18.0.21-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 | before 0:18.0.21-1.redhat_00001.1.el9sso | 0:18.0.21-1.redhat_00001.1.el9sso |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Snizi/CVE-2026-18963-Exploit | 2026-08-20 |
| PoC in GitHub | kyos-public/keycloak-cve-2026-18963-hunt | 2026-08-20 |
| PoC in GitHub | Red-Darkin/CVE-2026-18963-keycloak | 2026-08-24 |
| PoC in GitHub | T0w0T/POC-CVE-2026-18963 | 2026-08-24 |
| PoC in GitHub | minh3102011/CVE-2026-18963_analyst | 2026-08-24 |
| PoC in GitHub | BlackHatExploitation/Exploit-For-CVE-2026-18963 | 2026-08-25 |
| PoC in GitHub | debugactiveprocess/CVE-2026-18963 | 2026-08-25 |
| PoC in GitHub | gman0x00/keycloak-CVE-2026-18963 | 2026-08-25 |
| PoC in GitHub | prot0tw/Keycloak_CVE-2026-18963_PoC | 2026-08-25 |
| PoC in GitHub | alt3kx/CVE-2026-18963 | 2026-08-27 |
Show 9 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | EQSTLab/CVE-2026-18963 | 2026-09-01 |
| PoC in GitHub | 0xlyvio/CVE-2026-18963-keycloak | 2026-09-05 |
| PoC in GitHub | ynsmroztas/KeySniper | 2026-09-06 |
| PoC in GitHub | ivanesk315/CVE-2026-18963 | 2026-09-10 |
| PoC in GitHub | SonOfABot/-CVE-2026-18963-POC | 2026-10-08 |
| PoC in GitHub | hardeep-sudo/Keycloak-CVE-2026-18963-Exploit | 2026-10-08 |
| PoC in GitHub | orevim/CVE-2026-18963-PoC | 2026-10-15 |
| Exploit-DB | Keycloak 26.7.2 - Unauthenticated Account Takeover | 2026-10-21 |
| Nuclei | Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass |
What each source reports
CVE List Score used
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
- Record
CVE-2026-18963- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-640
- Updated
- 2026-11-12
EUVDEUVD-2026-61063
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
- Record
EUVD-2026-61063- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-4gv3-mc9p-5wqc
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
- Record
GHSA-4gv3-mc9p-5wqc- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-640
- Updated
- 2026-11-02
NVD
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
- Record
CVE-2026-18963- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-640
- Updated
- 2026-11-13
OSVGHSA-4gv3-mc9p-5wqc
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
- Record
GHSA-4gv3-mc9p-5wqc- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-640
- Updated
- 2026-11-02
OSVRHSA-2026:99764
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.14 security update on RHEL 7
- Record
RHSA-2026:99764- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:99765
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.14 security update on RHEL 8
- Record
RHSA-2026:99765- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:99766
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.14 security update on RHEL 9
- Record
RHSA-2026:99766- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVBIT-keycloak-2026-18963No score
Flaw in the reset-credentials flow of the keycloak-services component
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
- Record
BIT-keycloak-2026-18963- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | NVD, OSV | |
| references | CVE List | |
| products, references | EUVD, NVD | |
| products, references | CVE List, EUVD | |
| exploits, facts | PoC in GitHub | |
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:56519
Show 17 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2511595
cert-portal.siemens.com/productcert/html/ssa-503852.html
nvd.nist.gov/vuln/detail/CVE-2026-18963
github.com/keycloak/keycloak/issues/51833
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99764.json
cve.org/CVERecord?id=CVE-2026-18963