Warning: Critical Account Takeover via Password-reset Flow in Red Hat build of Keycloack, Patch I...

Not affected: Red Hat JBoss Enterprise Application Platform Expansion Pack And Red Hat Single Sign-On 7

Type: CWE-640: Weak Password Recovery Mechanism for Forgotten Password

CVE/CVSS: CVE-2026-18963: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Red Hat Build of Keycloak is Red Hat’s supported distribution of Keycloak, an identity and access management platform used for authentication, authorization, single sign-on (SSO), and identity federation. Because Keycloak sits directly in authentication flows and controls access to applications and services, vulnerabilities affecting its account-management functionality can have significant security consequences.

CVE-2026-18963 is a weak password recovery mechanism for forgotten password vulnerability (CWE-640) with a CVSS v3.1 Base Score of 9.1 in the reset-credentials flow of the keycloack-services component. Successful exploitation can be achieved remotely without requiring any prior privileges and any user interaction.

The vulnerability allows an attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion. In case of an intrusion, you can report an incident via . While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.