Keycloak Releases Patch for Critical Vulnerability That Could Allow Account Takeover via Password Reset

462/69 Tuesday, August 25, 2026 Security researchers have disclosed a Critical vulnerability, CVE-2026-18963, in Keycloak, an Identity and Access Management (IAM) system. The vulnerability has a CVSS severity score of 9.1 and occurs in the password reset process. It could allow unauthenticated attackers to change passwords and take over user accounts, including administrator accounts, without requiring any user interaction. At this time, there is no evidence that the vulnerability has been actively exploited, and no public exploit code has been observed. The vulnerability is caused by improper state validation in the reset-credentials process. An attacker could send a specially crafted request to the password reset endpoint, causing the authentication session to move directly to the password update step without requiring the action token that would normally be sent to the account owner’s email address. If successfully exploited, the attacker could set a new password and take control of the targeted account. Users of upstream Keycloak should update to version 26.7.2. Users of Red Hat build of Keycloak (RHBK) should install updates for release branches 26.4.15 and 26.6.6. For cases where immediate updating is not possible, Red Hat recommends disabling the Forgot password function in all realms as a temporary mitigation. Administrators should update to a fixed version as soon as possible. Source: https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html