Critical Keycloak Vulnerability Lets Attackers Hijack Any Account via Password Reset

Red Hat and the Keycloak developers have fixed a critical vulnerability in the popular open-source identity and access management server. The flaw, assigned the identifier CVE-2026-18963 and a CVSS score of 9.1, allows a remote, unauthenticated attacker to take over any account by forcing a password reset. Red Hat, which acts as the CVE-assigning coordinator for this defect, classified it as a weak forgotten-password recovery mechanism (CWE-640).

How it works

The root of the problem is “improper state validation during the reset-credentials authentication process” — that is, in the sequence Keycloak runs when handling a password recovery request. The attacker sends a specially crafted request to the relevant endpoint, after which the authentication session jumps straight to the password-change stage. The token that Keycloak normally emails is not required at all. The result is a full takeover of any user's account, including administrators.

The attack requires no involvement from the victim, which is what earned it a critical severity rating. According to researcher Enzo Mongin of Escape, who wrote about a different Keycloak vulnerability, an attacker who breaches the boundaries of such a server “gains access to everything behind it.”

What to do

Users of the upstream Keycloak version should upgrade to release 26.7.2, published on August 19, 2026. Customers of the Red Hat build of Keycloak are covered by builds 26.4.15 and 26.6.6; the corresponding fixes shipped on August 18. For those who cannot update immediately, Red Hat recommends a temporary measure — disabling the “Forgot password” feature in all realms (in the admin console: Realm settings → Login → Forgot password), stressing that the setting must be applied to every realm.

There is no evidence of the flaw being exploited in real-world attacks, and no public exploit had been found as of August 24. The vulnerability turned out to be one of eight closed in release 26.7.2 — which also fixed CVE-2026-15571, a predictable account-linking hash that likewise allowed account hijacking. Two weeks earlier, on August 5, version 26.7.1 closed twelve CVEs at once.

It remains an open question whether every realm with password recovery enabled is vulnerable, or only certain configurations of the reset-credentials flow — public sources do not clarify this. For reporting the issue, Red Hat thanked James Paremain.

Source: The Hacker News