← News
/DISPATCH · 2026-08-27

CVE-2026-18963: Keycloak Password-Reset Endpoint Skips Email Verification; Unauthenticated Attacker Can Reset Any Account Password

Red Hat and the open-source Keycloak project patched a critical authentication bypass in the password-reset flow, CVE-2026-18963, CVSS v3.1 9.1 (Critical). The bug sits in keycloak-services ResetCredentialEmail.action(

Red Hat and the open-source Keycloak project patched a critical authentication bypass in the password-reset flow, CVE-2026-18963, CVSS v3.1 9.1 (Critical). The bug sits in the `keycloak-services` component's `ResetCredentialEmail.action()` flow. Loose state checks let an unauthenticated remote attacker skip the email verification link and, without controlling the victim mailbox, enter the password-update stage and reset any username (including admin) to an attacker-chosen password. Keycloak is the identity core for many enterprise SSO, IDaaS, and self-hosted IdP deployments; one bypass takes the whole identity layer.

Incident Overview

CVE: CVE-2026-18963, CWE-640 Weak Password Recovery Mechanism for Forgotten Password. CVSS v3.1 base: 9.1 / Snyk 9.3, AV:N, AC:L, PR:N, UI:N. Disclosure: 18 Aug 2026 (NVD), updated 20 Aug; patch: 19 Aug 2026. Known in-the-wild: EPSS currently ~0.39%–2.79%, not on CISA KEV, but public PoC and Nuclei templates exist. Affected: Red Hat Build of Keycloak 26.6 before 26.6.6-1, 26.4 before 26.4.15-1; all upstream Keycloak builds from 26.0.0 through 26.7.2. Fixed: upstream Keycloak 26.7.2; Red Hat RHSA-2026:56519 / 56520 / 56523 / 56524.

Technical Details

Keycloak's standard reset-credentials flow proves mailbox control via a signed action token in email. Normal order: submit username → send email → user clicks link with action token → server validates token → password-update page.

CVE-2026-18963 root cause: step-order constraints broken. `ResetCredentialEmail` at the reset-credentials action entry over-trusts the prior authentication session's intermediate state and does not force-check that VERIFY_EMAIL or EXECUTE_ACTION_TOKEN actually completed. Attacker crafts one reset request that lands on the action step, skipping the prior verify step, and the session advances to password update.

Live path (in Nuclei templates and Snyk PoC):

`POST /realms/{realm}/login-actions/reset-credentials?execution=reset_credentials
POST /realms/{realm}/login-actions/reset-credentials
Content-Type: application/x-www-form-urlencoded

username=admin  &  new password=AttackerPwd123!  &  password-confirm=AttackerPwd123!`

If the request carries a valid session Cookie but no legitimate action token, the server still updates the password and returns a success page. Attacker then logs in as admin with the new password.

Impact Assessment

Keycloak typically backs enterprise SSO, customer-facing IDaaS, API-gateway auth, and web-console login. Once any user's password can be reset remotely, the attacker also gets:

No credentials, no user interaction. Scanners hit `/realms/{realm}/login-actions/reset-credentials` at high rates. Snyk EPSS puts 30-day exploitation probability at 0.39%–2.79% — mass scanning is likely; targeted use is a matter of time.

Remediation

References