Critical Account Takeover Vulnerability in Red Hat Keycloak

A critical vulnerability (CVE-2026-18963) has been identified in the reset-credentials flow of the keycloak-services component of Red Hat Build of Keycloak. This flaw allows unauthenticated attackers to reset passwords for any user without email verification, leading to potential account takeover. The vulnerability has been rated with a CVSS score of 9.1, indicating severe risk. Red Hat has advised immediate upgrades to patched versions or temporary disabling of the 'Forgot password' feature as a mitigation strategy. Organizations are urged to enhance monitoring and detection capabilities to identify suspicious activities. The flaw was reported by James Paremain, and the issue was published on August 18, 2026. The vulnerability affects all realms of the Keycloak service, posing a significant risk to user accounts.

Key Points: • CVE-2026-18963 allows password resets without user verification, enabling account takeovers. • The vulnerability has a CVSS score of 9.1, indicating a critical threat level. • Immediate upgrades or disabling of the 'Forgot password' feature is recommended as mitigation.