{"id":2502,"date":"2026-08-24T13:10:43","date_gmt":"2026-08-24T13:10:43","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2502"},"modified":"2026-08-24T13:10:43","modified_gmt":"2026-08-24T13:10:43","slug":"critical-keycloak-password-reset-flaw-could-let-unauthenticated-attackers-take-over-any-account","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2502","title":{"rendered":"Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Aug 24, 2026<\/span><\/span>Vulnerability \/ Identity Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.<\/p>\n

The vulnerability, assigned the CVE identifier CVE-2026-18963<\/strong>, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as the CVE Numbering Authority (CNA) for the flaw. It has been classified as a weak password recovery mechanism for a forgotten password (CWE-640).<\/p>\n

Users of upstream Keycloak are advised to update to version 26.7.2, released August 19, 2026, while customers running Red Hat build of Keycloak (RHBK) should apply the updates shipped for 26.4.15 and 26.6.6.<\/p>\n

There is no evidence that the flaw has been exploited, and no verified public exploit has been located as of August 24, 2026.<\/p>\n

Red Hat said in its CVE advisory<\/a> that the root cause is \u00abimproper state validation within the reset-credentials authentication flow,\u00bb the sequence Keycloak runs when a user requests password recovery. The company assessed the severity as Critical because an unauthenticated remote attacker can exploit the flaw without any user interaction.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The defect lies in how the flow’s state is managed, according to the Red Hat bug report<\/a>. An attacker sends a specially crafted request to the reset-credentials endpoint. The authentication session then transitions directly to the password update phase. The action token that Keycloak normally sends via email is never required.<\/p>\n

<\/p>\n

Successful exploitation results in a complete account takeover of any user, \u00abincluding administrative accounts,\u00bb by resetting their password.<\/p>\n

Escape researcher Enzo Mongin, writing about a separate Keycloak access-control flaw<\/a> he disclosed in July, said an attacker who crosses one of the server’s boundaries does not stop at Keycloak, and that \u00abthey get into everything sitting behind it.\u00bb<\/p>\n

Red Hat issued four errata on August 18, 2026 (RHSA-2026:56519<\/a>, RHSA-2026:56520<\/a>, RHSA-2026:56523<\/a> and RHSA-2026:56524<\/a>), covering the standalone server packages and the container images for two RHBK streams. The fixed versions<\/a> are as follows –<\/p>\n