NCSC-NL says Red Hat fixed multiple Keycloak flaws, including CVE-2026-18963, where an unauthenticated attacker can force a password reset and take over any user account without seeing the email token. On day three of reporting, the advisory makes the consequence explicit: this is account takeover, not just a broken recovery flow.
The bug sits in Keycloak's reset-credentials path. A crafted request can skip the normal email-verification step and move straight to password change, so the site accepts a reset that was never proven through the victim's mailbox. NCSC-NL also notes separate admin, account-linking, secret-rotation, library, and database issues in the same advisory.
For organizations that use Keycloak or Red Hat Build of Keycloak as the login layer for other apps, the exposure sits at the identity boundary. If the reset flow is reachable, recovered passwords may not mean the user recovered the account, and downstream sessions can inherit that compromise.
2 sources · Aug 25
CVEs in this update
7 CVEs
Across BigFix, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, and related packages.
De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen.