CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Updated
- CVSS 3.1
- 9.1 CRITICAL
- EPSS
- 6.6% (94th pct)
- CISA KEV
- Not listed
- Published
- 2026-08-18
- Weakness
- CWE-640
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Key Findings
as of 2026-11-12- Its current EPSS score (6.6%) is higher than that of 19% of CISA KEV entries.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CVSS calculator Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Red Hat | Red Hat Red Hat build of Keycloak 26.4 | 26.4.15-1 to <* (unaffected) |
| Red Hat | Red Hat Red Hat build of Keycloak 26.4 | 26.4-23 to <* (unaffected) |
| Red Hat | Red Hat Red Hat build of Keycloak 26.4 | 26.4-23 to <* (unaffected) |
| Red Hat | Red Hat Red Hat build of Keycloak 26.4.15 | - |
| Red Hat | Red Hat Red Hat build of Keycloak 26.4.15 | - |
| Red Hat | Red Hat Red Hat build of Keycloak 26.6 | 26.6.6-1 to <* (unaffected) |
| Red Hat | Red Hat Red Hat build of Keycloak 26.6 | 26.6-12 to <* (unaffected) |
| Red Hat | Red Hat Red Hat build of Keycloak 26.6 | 26.6-12 to <* (unaffected) |
| Red Hat | Red Hat Red Hat build of Keycloak 26.6.6 | - |
| Red Hat | Red Hat Red Hat build of Keycloak 26.6.6 | - |
| Red Hat | Red Hat Red Hat build of Keycloak 26.6.6 | - |
| Red Hat | Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack | - |
| Red Hat | Red Hat Red Hat Single Sign-On 7 | - |
References
6 linksVendor advisories
Vulnerability databases
Issue trackers
Record Details
- Published
- 2026-08-18
- Last updated
- 2026-10-23
- Assigner (CNA)
- redhat
- Credited to
- Red Hat would like to thank James Paremain for reporting this issue.
More from Red Hat
Samba: remote code execution in samr
Samba: samba: remote code execution in printing subsystem via unescaped job description
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.