A critical vulnerability (CVSS 9.1) in Keycloak lets an unauthenticated attacker reset any user’s password, including admin accounts, without access to the victim’s inbox and without any interaction from them. All versions below 26.7.2 are affected. The fix has been available since August 19, 2026. If you can’t update immediately, disable „Forgot password” across all realms.
What is Keycloak
Keycloak is an open-source identity and access management (IAM) system maintained by Red Hat. It handles SSO, identity federation, OAuth 2.0, and OpenID Connect. In enterprise environments it typically sits in front of internal applications, developer portals, Kubernetes environments, and CI/CD tooling – often as the single gateway controlling who has access to what. Red Hat Build of Keycloak (RHBK) is the commercially supported distribution for Red Hat customers.
What the bug does?
CVE-2026-18963 is an improper state validation flaw classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) in the reset-credentials authentication flow.
The normal password reset flow: user enters their email → receives a link with an action token → clicks it → sets a new password. The token is single-use, has a short TTL, and is tied to a specific session.
The flaw: Keycloak doesn’t properly verify which stage of that flow a session is actually in. An attacker can send a crafted request to the reset-credentials endpoint that causes the session to jump directly to the password update phase – no token, no email, no contact with the victim whatsoever. Knowing a username or email address is enough.
No authentication required. Works on admin accounts.
Why a compromised Keycloak admin account is serious?
Keycloak sits in front of your entire infrastructure. Someone who resets an admin password can: disable MFA for other users, create new accounts with full privileges, reset passwords for everyone in the system, register OAuth clients with access to any resource Keycloak protects. If Keycloak guards ten systems, a compromised admin means access to all ten.
Timeline
| Date | Event |
|---|---|
| August 18, 2026 | Red Hat releases errata RHSA-2026:56519, :56520, :56523, :56524 |
| August 19, 2026 | Keycloak 26.7.2 publicly available |
| August 24, 2026 | CVE-2026-18963 publicly disclosed |
Five days passed between the fix and the public announcement, standard window to let admins patch before the details go wide. As of August 24 there is no evidence of active exploitation and no public exploit has surfaced, but that tends to change quickly once a CVE is published.
Affected versions
Upstream Keycloak: all versions below 26.7.2. Safe version: 26.7.2 (released August 19, 2026).
Red Hat Build of Keycloak (RHBK):
- stream 26.4: safe from 26.4.15-1 (RHSA-2026:56519)
- stream 26.6: safe from 26.6.6-1 (RHSA-2026:56523)
Keycloak 26.7.2 patches eight CVEs in total, including CVE-2026-15571, a vulnerability in account linking via hash.
How to check your version?
The version appears in the footer of the admin console. You can also check via CLI or API:
bash
# command line
/opt/keycloak/bin/kc.sh --version
# API
GET /auth/realms/master
# check the "keycloak-version" field in the JSON responseWhat to do
Update to Keycloak 26.7.2 or the appropriate RHBK version. That’s the only permanent fix.
If you can’t update right now: disable „Forgot password” across all realms. Admin console → Realm settings → Login tab → Forgot password → off. This removes the attack vector but takes self-service password reset away from your users, so treat it as a stopgap.
After patching, review logs for suspicious requests to the reset-credentials endpoint from the period before the fix was applied.
Context
August has been busy for Keycloak. Version 26.7.1 (August 5) fixed twelve CVEs, including a flaw in SAML identity-provider-initiated broker login and a bug in the default dynamic client registration policy. Two major releases in one month, twenty CVEs total. If Keycloak in your environment hasn’t been updated since before the summer, you’re behind on both.
If you’re running Red Hat products more broadly, it’s worth checking the Red Hat Security Advisories page – August has been active across the portfolio.
