Keycloak CVE-2026-18963 Lets Anyone Reset Anyone's Password, No Email Click Needed

The password reset button is the way in. Red Hat and the Keycloak project have patched CVE-2026-18963, an unauthenticated account takeover in the reset-credentials flow that scores CVSS 9.1. No credentials needed, no prior access, and no interaction at all from the person whose account gets taken.

What Keycloak CVE-2026-18963 does

The cause is improper state validation in the password recovery sequence. Normally that sequence has a gate in it: you request a reset, Keycloak emails you a link, you click the link, and only then does the flow move you to the "set a new password" stage.

The flaw lets an attacker send a crafted request that jumps the session straight to that final stage. The email verification step is skipped entirely. Whoever they point it at, they own.

Keycloak sits in front of a very large amount of self-hosted infrastructure as the identity layer, which is what makes this ugly. The blast radius is not Keycloak. It is every application behind the single sign-on.

The fix, in order

1. Upstream Keycloak: update to 26.7.2, released 19 August 2026. 2. Red Hat build of Keycloak: apply 26.4.15 or 26.6.6. The advisories are RHSA-2026:56519, 56520, 56523 and 56524. 3. Cannot patch today? Disable the built-in reset-credentials flow at realm level and switch to administrator-driven resets. It is inconvenient and it closes the hole. 4. After patching, force a password reset and revoke active sessions for all admin and service accounts. Patching does not undo a takeover that already happened. 5. Audit your realm event logs for unexpected UPDATE_PASSWORD events. That is your indicator of compromise.

Where this sits against the rest of August

This is the third identity-adjacent scramble in a fortnight. Zimbra's SNMP flaw went under active exploitation with CISA giving federal agencies a three-day window, and Oracle shipped 943 security patches in its August cycle. If you are not sure how seriously to take a 9.1, our guide on how to read a CVSS score explains what the number is actually measuring.

Why reset flows keep breaking

Password recovery is deliberately designed to work for someone who has lost access to their account. That is its entire job. It has to be usable by a person with no password, no session and possibly no device.

Every other part of an authentication stack gets to be suspicious. The recovery path is not allowed to be, at least not in the same way, so it ends up carrying more state and more branching than anything else in the system. When the state machine has a hole in it, the recovery path becomes the attack path.

The practical defence for the accounts that matter most is a second factor that cannot be phished or reset by email. A hardware security key covers that: the YubiKey 5 NFC is available on Amazon and works with Keycloak's WebAuthn support out of the box.

Bottom line

26.7.2 upstream. 26.4.15 or 26.6.6 on Red Hat. Then revoke admin sessions and read your logs, because a patch applied on Tuesday says nothing about what happened last week.

Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.