#keycloak
-
Critical Keycloak Vulnerability Lets Attackers Hijack Any Account via Password Reset
Red Hat and the Keycloak project have released patches for the critical flaw CVE-2026-18963 (CVSS 9.1): an unauthenticated attacker can take over any account, including an administrative one, by forcing the system to reset the password.