CVE-2026-18963

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Red Hat Keycloak Services

Publication date: 2026-08-18

Last updated on: 2026-08-20

Assigner: redhat-SADP

Description

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-20

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-18963

EUVD

EUVD-2026-61063

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	keycloak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability is in the reset-credentials flow of Red Hat Build of Keycloak. An unauthenticated attacker can bypass email verification and force a password reset for any user, gaining full control over their accounts by setting new credentials.

Detection Guidance

Monitor Keycloak logs for unusual password reset requests without corresponding email verification steps. Check for repeated requests to the reset-credentials endpoint from the same IP addresses or unexpected user accounts.

Impact Analysis

Attackers can take over any user account, including administrative ones, without needing to interact with the victim. This could lead to unauthorized access to sensitive data, system control, or further attacks within the environment.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Disable the reset-credentials flow in Keycloak if possible. Restrict network access to the reset endpoint using firewalls or WAF rules. Monitor for suspicious activity and apply patches or updates as soon as they become available from Red Hat.

Hi! I’m here to help you understand CVE-2026-18963. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70