Critical Keycloak Flaw Lets Attackers Reset Any Account Password Without Authentication

Overview

A critical authentication bypass vulnerability has been disclosed in Keycloak, the widely-deployed open-source identity and access management (IAM) platform used by enterprises for single sign-on (SSO), OAuth 2.0, and OpenID Connect workflows. Tracked as CVE-2026-18963 with a CVSS score of 9.1 CRITICAL, the flaw allows an unauthenticated remote attacker to take over any user account — including administrator accounts — by exploiting a state validation error in the password reset flow.

Keycloak 26.7.2, released August 19, 2026, patches this vulnerability along with six others. Organizations running Keycloak in any capacity should treat this as an urgent patch.

Technical Analysis

The Vulnerability

The flaw resides in Keycloak's reset-credentials authentication flow — the mechanism that handles "Forgot password" requests. Under normal operation, this flow sends an action token to the user's registered email address. The user must click that link to prove ownership of the account before being permitted to set a new password.

CVE-2026-18963 is an improper state validation error. By sending a specially crafted request to the reset-credentials endpoint, an attacker can cause the authentication session's state to advance past the email verification step — directly to the password update phase — without ever receiving or presenting the action token.

The result: a fully unauthenticated attacker can reset the password of any account in any realm, including accounts with administrative privileges.

Attack Characteristics

Scope of Risk

Keycloak is commonly deployed as the authentication backbone for entire application ecosystems. A successful exploit against a Keycloak instance does not merely compromise a single user account — it may provide a pivot point into:

• Admin consoles of every application realm managed by that Keycloak deployment
• Federated identities linked to the compromised account across connected applications
• Service accounts used by applications for backend API authentication
• Internal SSO portals behind which sensitive business systems sit

The blast radius of a single successful exploit can be organization-wide.

Affected Versions

Note: The 26.7.2 release also addresses CVE-2026-15571, a separate account takeover via predictable account-linking hash, among five other CVEs.

Remediation

Immediate: Apply the Patch

Update to Keycloak 26.7.2 (upstream) or the corresponding Red Hat operator bundle for your stream. This is the only complete fix.

Interim Workaround (Pre-Patch)

If an immediate upgrade is not possible, Red Hat recommends disabling the "Forgot password" feature across all realms:

1. Open the Keycloak Administration Console.
2. Navigate to Realm settings → Login.
3. Toggle Forgot password to Off.
4. Repeat for every realm in the deployment.

This removes the vulnerable attack surface but also disables legitimate password recovery for users — communicate this change to helpdesk teams before applying.

Additional Hardening

• Audit realm configurations — ensure admin accounts are protected by MFA in addition to passwords. Account takeover that resets a password is ineffective against TOTP/WebAuthn-protected accounts.
• Review access logs — look for unexpected activity in reset-credentials flows prior to patching. Any successful completions that did not originate from a legitimate user session warrant investigation.
• Network segment Keycloak — limit network access to the Keycloak management interface to trusted administrator subnets only.

Context: Keycloak's Vulnerability Surface

This is not the first critical authentication flaw in Keycloak. The platform's complexity — supporting dozens of authentication flows, federated identity providers, and extensible SPI hooks — creates a large attack surface. Organizations that self-host Keycloak carry the full burden of keeping it patched and hardened.

For teams on Red Hat Single Sign-On (RHSSO) or Red Hat build of Keycloak, ensure your operator is configured for timely updates and that your vulnerability management program covers Keycloak as a Tier 1 critical system.

References

• The Hacker News — Critical Keycloak Password Reset Flaw
• Keycloak 26.7.2 Release Notes
• Red Hat CVE Advisory — CVE-2026-18963