Red Hat and the Keycloak project have patched a critical flaw in the open-source identity server that lets an unauthenticated attacker reset the password of any account — including administrator accounts — without ever receiving the email confirmation Keycloak is supposed to send. The vulnerability, CVE-2026-18963, carries a CVSS score of 9.1. It exploits improper state management in the reset-credentials authentication flow: an attacker sends a crafted request that skips the email verification step entirely and lands directly on the password update screen, completing a full account takeover without any user interaction.
No evidence of active exploitation has been reported as of August 24, 2026, but the severity and ease of attack make rapid patching urgent. Because Keycloak acts as a central identity broker for many downstream services, a compromised Keycloak administrator account typically grants full access to every application behind it. Red Hat credited researcher James Paremain with discovering the flaw. The same Keycloak 26.7.2 release also fixes CVE-2026-15571, a separate account takeover via a predictable account-linking hash in OpenID Connect clients.
How to check if you’re affected
Affected versions include all Keycloak releases older than 26.7.2, and all Red Hat build of Keycloak (RHBK) versions older than 26.4.15 and 26.6.6. Check your Keycloak version in the administration console under Server Info. If you cannot update immediately, disable the “Forgot password” feature in every realm under Realm Settings → Login → Forgot password — this removes the vulnerable code path until you can apply the patch.