Red Hat patches critical Keycloak password reset account takeover flaw

Red Hat and the Keycloak project have released fixes for CVE-2026-18963, a critical password-reset vulnerability in the open-source identity and access management server. Red Hat assigned the issue a CVSS score of 9.1 because an unauthenticated remote attacker could reset the password of any user account, including administrative accounts.

Upstream users are advised to upgrade to Keycloak 26.7.2, released on August 19, 2026. Customers using Red Hat build of Keycloak (RHBK) should apply the available updates for versions 26.4.15 and 26.6.6. As of August 24, no evidence of exploitation and no verified public exploit had been identified.

Reset flow can bypass the email token

Red Hat classifies CVE-2026-18963 as CWE-640, a weak password-recovery mechanism. The company identified improper state validation in Keycloak's reset-credentials authentication flow, which manages password recovery requests.

An attacker can send a specially crafted request to the reset-credentials endpoint. The affected authentication session can then transition directly to the password-update stage, without requiring the action token that Keycloak normally sends to the user's email address. The result is a full account takeover through a forced password reset.

The issue is especially significant for identity infrastructure because a compromised Keycloak account may provide access to applications and services that rely on it for authentication. Escape researcher Enzo Mongin, discussing a separate Keycloak access-control issue disclosed in July, noted that crossing a Keycloak boundary can expose systems sitting behind the identity platform.

Fixed releases and Red Hat errata

Red Hat issued four errata on August 18: RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523 and RHSA-2026:56524. They cover standalone server packages and container images for two RHBK streams.

• RHBK 26.4 is unaffected from operator bundle 26.4.15-1 and from the rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator images at 26.4-23.
• RHBK 26.6 is unaffected from operator bundle 26.6.6-1 and from the keycloak-rhel9 and operator containers at 26.6-12.
• Upstream Keycloak is fixed in version 26.7.2.

Keycloak 26.7.2 lists eight resolved CVEs, including CVE-2026-15571, which concerns a predictable account-linking hash involving a malicious OpenID Connect client. The available advisories do not establish whether every realm with forgotten-password enabled is exploitable or whether exposure depends on particular reset-credentials flow configurations.

Temporary mitigation for delayed upgrades

For deployments that cannot be patched immediately, Red Hat recommends disabling the Forgot password function in every realm. In the RHBK administration console, the setting is available under Realm settings, then Login, then Forgot password.

Univention said its Nubus deployments are not affected because the forgotten-password function is not enabled. For other organisations, the practical priority is to inventory Keycloak and RHBK instances, apply the fixed release or image versions, verify realm-level configuration, and use the temporary control only until upgrades are complete.