Red Hat · Red Hat build of Keycloak 26.4
A flaw in the reset-credentials flow of the keycloak-services component, the core identity and access management engine in Red Hat build of Keycloak 26.4, lets the process for resetting passwords be bypassed. An unauthenticated remote attacker, with no user interaction required, can force a password reset for any user without completing the email verification step and set new credentials on the target account.
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
First seen exploited 7 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.
5 fixes in keycloak-services over 4 months. The latest fix listed for keycloak-services is 26.7.2.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.keycloak:keycloak-services.
Upgrade to 26.7.2 or later
Set the version to 26.7.2 or later in your pom.xml or build.gradle.
The first fix for CVE-2026-18963.
| If you run | Upgrade to |
|---|---|
| 26.7.0 up to 26.7.2 | 26.7.2 |
| 26.5.0 up to 26.6.6 | 26.6.6 |
| 26.0.0 up to 26.4.15 | 26.4.15 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.