Summary

CVE-2026-18963 is a critical vulnerability in the keycloak-services component of Red Hat Build of Keycloak that affects the password/credential reset workflow.

The vulnerability allows an unauthenticated remote attacker to bypass the required email verification step and reset the password of an arbitrary Keycloak user. Successful exploitation can result in complete takeover of the targeted account, including privileged administrator accounts. The vulnerability is classified as CWE-640: Weak Password Recovery Mechanism for Forgotten Password. The issue was published to the NVD on 18 August 2026 and updated on 20 August 2026.

Red Hat has released security updates addressing the vulnerability through RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524.

Affected Systems and/or Applications

The following systems and components should be considered potentially affected:

• Red Hat Build of Keycloak
• keycloak-services component
• Red Hat identity and access management deployments covered by:
  • RHSA-2026:56519
  • RHSA-2026:56520
  • RHSA-2026:56523
  • RHSA-2026:56524

Organizations should verify the exact versions deployed in their environments against the fixed versions specified in the applicable Red Hat security advisory.

Systems exposing Keycloak account-management or reset-credentials functionality to untrusted networks should be treated as particularly high risk.

Technical Details

The vulnerability exists in the reset-credentials authentication flow within keycloak-services. Under normal operation, Keycloak sends the user a reset email containing a signed action token. The user must follow the verification link before being permitted to set a new password. This process provides proof that the requester has access to the account's registered email address.

CVE-2026-18963 allows an unauthenticated attacker to manipulate the reset workflow so that the password-setting stage can be reached without successfully completing the email verification step. An attacker who knows or can determine a target username or email address may therefore initiate the password reset process and submit new password credentials without possessing the victim's email account.

The underlying root cause is a broken step-ordering constraint in the reset-credentials execution flow. Intermediate authentication-session state is trusted without sufficiently enforcing that the required verify-email or equivalent action-token step was successfully completed.

Attack Characteristics

• Attack origin: Remote/network
• Authentication required: None
• Victim interaction: None
• Required information: Target username or email address
• Primary impact: Account takeover
• Confidentiality impact: High
• Integrity impact: High
• Availability impact: None

No verified public exploit code is currently identified in the supplied information.

Detection and Indicators of Compromise

Security teams should review Keycloak audit and realm event logs for evidence of exploitation.

Potential indicators include:

• UPDATE_PASSWORD events that are not preceded by a corresponding VERIFY_EMAIL or EXECUTE_ACTION_TOKEN event within the same user session.
• A high volume of RESET_PASSWORD attempts against multiple accounts from a single IP address or client identifier.
• Password-reset flows that complete without evidence of email action-token consumption.
• Unexpected password changes involving privileged or high-value accounts.
• Access to Keycloak reset-credential endpoints, particularly:
  • /realms/{realm}/login-actions/reset-credentials
  • Related action-token endpoints.
• Authentication from a new device or geographic location immediately following an unexpected password reset.
• Unexpected MFA re-enrollment or changes to account security settings following a password reset.

Mitigation

1. Patch all affected Keycloak deployments as a priority. Apply the updates provided in:
   • RHSA-2026:56519
   • RHSA-2026:56520
   • RHSA-2026:56523
   • RHSA-2026:56524
2. Verify the installed Keycloak version against the fixed versions specified by Red Hat for the applicable deployment channel.
3. Review Keycloak logs for evidence of exploitation dating back to the beginning of the potential exposure period.
4. Pay particular attention to unauthorized UPDATE_PASSWORD events and password changes that lack a corresponding verified email/action-token event.
5. Following patch deployment, force password resets and revoke active sessions for high-value accounts, particularly Keycloak administrators and other privileged accounts, where compromise cannot be ruled out.

Temporary Workarounds

Until the affected systems can be patched, organizations should consider:

• Disabling the built-in password-reset functionality at the realm level and using administrator-driven password resets.
• Restricting network exposure of Keycloak login-action endpoints to trusted networks where operationally feasible.
• Using a web application firewall or equivalent security control to restrict and rate-limit access to reset-credential endpoints.
• Enforcing MFA for Keycloak users and downstream applications to reduce the impact of compromised passwords.

For environments using kcadm.sh, the supplied workaround is:

# Temporarily disable the built-in reset-credentials flow
# Replace REALM with the target realm name
kcadm.sh update realms/REALM -s resetPasswordAllowed=false


This workaround should be regarded as temporary - applying the vendor-provided security updates remains the recommended remediation.

Customers using Tenable: Plugin 338317

What the Cyber Fusion Center is Doing

The CFC is actively monitoring threat intelligence and reports related to CVE-2026-18963. This advisory will be updated if required.

References

• Red Hat - CVE-2026-18963 Security Advisory
• NVD - CVE-2026-18963

‍