Keycloak Reset Bypass Reaches Every App Behind SSO
Red Hat and the Keycloak project patched CVE-2026-18963, a critical flaw that lets an unauthenticated attacker reset Keycloak passwords without receiving the emailed action token. Upstream Keycloak is fixed in 26.7.2, and Red Hat build of Keycloak has fixes in 26.4.15 and 26.6.6 streams.
Red Hat says the bug is improper state validation in the reset-credentials flow: a crafted request can push the session straight to the password-change step, so the normal email check never happens. That makes the issue account takeover, not just a broken recovery page, and it can hit administrative accounts too.
For shops using Keycloak as the login gate for multiple apps, the blast radius sits at the trust boundary Keycloak enforces. If a forgotten-password flow is exposed in your realm, the exposure can extend to downstream services and federated sessions even when the original reset email was never seen.