Keycloak password reset flaw let anyone skip the email token and take over any account

Keycloak patched CVE-2026-18963 on August 19, 2026, a CVSS 9.1 flaw that allowed unauthenticated account takeover through the password reset endpoint. The reset-credentials authentication flow validated its own state improperly: a crafted request advanced the authentication session directly to the update-password execution, skipping the send-reset-email step that issues and checks the verification token. An attacker needs a username or email address and nothing else. Administrative accounts are in scope. Fixed in upstream 26.7.2 and in Red Hat build of Keycloak 26.4.15-1 and 26.6.6-1. Reported by James Paremain. No public exploit and no observed exploitation as of publication.

Why it matters

Account recovery is an authentication path that gets designed as a support feature. Every control at the front door, phishing-resistant MFA included, is worth nothing against a reset flow that hands over the password on request, and this is the second Keycloak flaw in our catalog to turn a flow-state assumption into a takeover after CVE-2023-6787. Because Keycloak is the identity provider rather than an app behind one, the blast radius is every service that trusts it for SSO. Upgrade, then hunt the admin event log for UPDATE_PASSWORD events with no matching SEND_RESET_PASSWORD for the same user and session, and require step-up authentication on the admin console so a password alone does not administer the realm.

Source: The Hacker News