Vulnerabilities · 49 days ago
NCSC-NL says Red Hat fixed multiple Keycloak flaws, including CVE-2026-18963, where an unauthenticated attacker can force a password reset and take over any user account without seeing the email token. On day three of reporting, the advisory makes the consequence explicit: this is account takeover, not just a broken recovery flow.
The bug sits in Keycloak's reset-credentials path. A crafted request can skip the normal email-verification step and move straight to password change, so the site accepts a reset that was never proven through the victim's mailbox. NCSC-NL also notes separate admin, account-linking, secret-rotation, library, and database issues in the same advisory.
For organizations that use Keycloak or Red Hat Build of Keycloak as the login layer for other apps, the exposure sits at the identity boundary. If the reset flow is reachable, recovered passwords may not mean the user recovered the account, and downstream sessions can inherit that compromise.
CVEs in this update
7 CVEs
Across BigFix, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, and related packages.
1 critical · 0 high · 6 medium · 0 low
0 in CISA KEV · 1 with EPSS above 1%
Highest severity: CVE-2026-18963 · 9.1 CRITICAL
Highest EPSS: CVE-2026-18963 · 3.2%
2 sources covering this story
Kwetsbaarheden verholpen in Keycloak
De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen.
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Keycloak CVE-2026-18963 could let unauthenticated attackers skip the emailed action token and reset any user's password.
Part of the PlainSec briefing for 2026-08-26