**Red Hat** and the **Keycloak** project have released patches to address a critical security vulnerability in the open-source identity and access management server. This flaw could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. ## Understanding CVE-2026-18963 The vulnerability, assigned the identifier **CVE-2026-18963**, is rated 9.1 on the CVSS scoring system by **Red Hat**, which serves as the CVE Numbering Authority (CNA) for this flaw. It has been classified as a weak password recovery mechanism for a forgotten password (**CWE-640**). The root cause is identified as "improper state validation within the reset-credentials authentication flow," the sequence **Keycloak** executes when a user requests password recovery. **Red Hat** assessed the severity as Critical due to the ability for an unauthenticated remote attacker to exploit it without user interaction. ## How the Exploit Works According to the **Red Hat** bug report, the defect lies in how the flow's state is managed. An attacker can send a specially crafted request to the `reset-credentials` endpoint. This causes the authentication session to transition directly to the password update phase, bypassing the need for the action token typically sent via email. Successful exploitation results in a complete account takeover of any user, including administrative accounts, by resetting their password. ## Urgent Patching and Mitigation Users of upstream **Keycloak** are advised to update to version 26.7.2, released August 19, 2026. Customers running **Red Hat build of Keycloak (RHBK)** should apply updates shipped for versions 26.4.15 and 26.6.6. As of August 24, 2026, there is no evidence of the flaw being actively exploited, and no verified public exploit has been located. **Red Hat** issued four errata on August 18, 2026 (**RHSA-2026:56519**, **RHSA-2026:56520**, **RHSA-2026:56523**, and **RHSA-2026:56524**), covering standalone server packages and container images for two **RHBK** streams. The fixed versions are: * **Red Hat build of Keycloak 26.4**: Unaffected from operator bundle 26.4.15-1, and from the `rhbk/keycloak-rhel9` and `rhbk/keycloak-rhel9-operator` images 26.4-23. * **Red Hat build of Keycloak 26.6**: Unaffected from operator bundle 26.6.6-1 and from the `keycloak-rhel9` and operator containers 26.6-12. * **Upstream Keycloak**: Fixed in 26.7.2. For deployments that cannot be updated immediately, **Red Hat** has published a temporary mitigation: disable the "Forgot password" functionality across all realms. This setting is found under Realm settings > Login > Forgot password in the **RHBK** administration console. This mitigation must be applied to every realm, and upgrading to a fixed version remains the primary recommendation. ## Broader Context of Keycloak Vulnerabilities **CVE-2026-18963** was one of eight CVE identifiers listed as fixed in the **Keycloak 26.7.2** release notes. This release also addressed **CVE-2026-15571**, a predictable account-linking hash that could enable account takeover through a malicious **OpenID Connect (OIDC)** client. Two weeks prior, on August 5, 2026, **Keycloak 26.7.1** shipped fixes for twelve CVEs, including issues related to **SAML** identity-provider-initiated broker login bypassing link-only restrictions, and a default dynamic client registration policy allowing role forgery via user property mappers. Escape researcher **Enzo Mongin**, who disclosed a separate **Keycloak** access-control flaw (**CVE-2026-17059**) in July, highlighted the significant risk of **Keycloak** vulnerabilities, noting that an attacker who compromises the server can gain access to all systems protected by it. **Univention** has confirmed that its **Nubus** product is not affected by **CVE-2026-18963**, as the forgotten-password feature is not activated in their **Keycloak** deployments. **Red Hat** credited **James Paremain** with reporting the flaw.