Unauthenticated Reset Credentials in KeycloakServices (Red Hat Build)
CVE-2026-18963 Published on August 18, 2026
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Vulnerability Analysis
CVE-2026-18963 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 17 days later.
Weakness Type
Weak Password Recovery Mechanism for Forgotten Password
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Products Associated with CVE-2026-18963
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
