By ByteBot
Keycloak has a critical authentication flaw — CVE-2026-18963, CVSS 9.1 — that lets an unauthenticated attacker reset any user’s password without ever clicking a verification email. Admin accounts included. The patch shipped August 19 as version 26.7.2. If you’re running Keycloak today, you’re already five days behind.
What Broke
The bug lives in Keycloak’s password reset flow — the sequence triggered when a user hits “Forgot password.” Normally, it works like this: user requests a reset, Keycloak sends a signed token via email, user clicks the link to prove inbox ownership, then and only then is the password-set step allowed.
CVE-2026-18963 breaks the state check in step three. An attacker can send a crafted request to the reset-credentials endpoint, and the session jumps straight to the password-update phase without any email token validation. The attacker just needs to know a target username. No credentials. No victim interaction. A pure network-accessible exploit against the Keycloak account console or its REST endpoints.
This is a state machine bug — the server fails to enforce that prior steps were actually completed before advancing the flow. It’s a class of vulnerability that has appeared in commercial auth providers before. The irony is that “Forgot password” flows are designed to be lenient; when your implementation of that leniency skips state checks, the entire authentication contract collapses.
Who Is Affected
Every upstream Keycloak installation below version 26.7.2 is vulnerable. If you run Red Hat Build of Keycloak (RHBK), the affected versions are below 26.4.15 on the 26.4.x branch and below 26.6.6 on the 26.6.x branch.
The attack surface is broad. “Forgot password” is enabled by default in every Keycloak realm. That means any fresh deployment — unless an admin explicitly turned it off — is exposed. And with Keycloak powering SSO for 11,500+ organizations worldwide (including the auth backbone of Red Hat OpenShift), a compromised Keycloak admin account means the attacker has the keys to every application behind that realm.
How to Patch
The fix is straightforward. Check your current version first:
./bin/kc.sh --versionIf you’re on upstream Keycloak, upgrade to 26.7.2. Via container:
docker pull quay.io/keycloak/keycloak:26.7.2For RHBK deployments, apply 26.4.15 (if you’re on the 26.4.x branch) or 26.6.6 (if on 26.6.x) via the Red Hat subscription portal. Full release notes, including the seven other CVEs fixed in this batch, are on the GitHub release page.
If You Cannot Patch Today
Red Hat published a temporary mitigation: disable “Forgot password” across all your realms. Navigate to Realm Settings → Login → Forgot password and set it to off. This must be applied per-realm — there is no global switch. It removes the attack surface entirely until you can schedule an upgrade.
It’s a blunt instrument. Users locked out of their accounts will need admin-assisted password resets in the interim. That’s an inconvenience worth accepting over leaving a CVSS 9.1 exploit path open on your identity provider.
Check Whether You Were Already Hit
No public exploit code has been confirmed as of August 24. But the vulnerability is publicly documented — the GitHub issue is public, and Kudelski Security published a full technical breakdown. That window does not stay closed.
Pull your Keycloak admin event logs for the past 30 days and look for UPDATE_PASSWORD events that were not preceded by a VERIFY_EMAIL or EXECUTE_ACTION_TOKEN event in the same session. Any match is suspicious. Multiple RESET_PASSWORD initiations against different accounts from a single IP in a short window is a red flag worth escalating.
If you find anomalies: force-reset credentials for affected accounts, rotate your realm admin password, and treat the deployment as potentially compromised until you’ve completed a full audit.
The Broader Point
Auth infrastructure sits under everything. Developers who run their own IAM stack take on the responsibility of patching it — quickly, and seriously. Keycloak’s zero per-MAU cost compared to Auth0 or Okta is compelling, and it remains the right choice for teams with data sovereignty requirements. But self-hosting auth means that when a CVSS 9.1 drops, there’s no vendor pushing an automatic update. That’s on you.
The Hacker News has full coverage. The Kudelski Security write-up goes deeper on the root cause if you need to explain it to your security team. The fix is a version bump. Run it.
