Keycloak Fixes Critical CVE-2026-18963 Password Reset Flaw Allowing Unauthenticated Account Takeover
Keycloak has patched a critical vulnerability tracked as CVE-2026-18963 that lets remote unauthenticated attackers force a password reset for any user and seize control of the account. The flaw affects the reset-credentials flow due to improper state validation, enabling attackers to bypass email verification and reach the password change endpoint directly. With a CVSS 3.1 score of 9.1, the issue requires no privileges or user interaction and impacts confidentiality and integrity. Patches are available in Keycloak 26.7.2 and corresponding Red Hat Build of Keycloak releases 26.4.15 and 26.6.6. Organizations unable to update immediately should disable the Forgot password feature across all realms. Post-remediation auditing of login events and credential changes on privileged accounts is recommended to detect any prior exploitation attempts.
HispasecAug 25, 2026Translated from Spanish