Red Hat and the Keycloak project have issued patches for a critical security vulnerability in the open-source identity and access management server that could let an unauthenticated remote attacker take control of any user account by forcing a password reset. The flaw, designated CVE-2026-18963, received a severity rating of 9.1 out of 10 on the CVSS scale from Red Hat, which serves as the CVE Numbering Authority for this vulnerability. The defect has been categorized as a weak password recovery mechanism for forgotten credentials.
Users running upstream Keycloak need to upgrade to version 26.7.2, which was released on August 19, 2026, while those operating Red Hat build of Keycloak (RHBK) must apply updates for versions 26.4.15 and 26.6.6. According to Red Hat's advisory, the underlying cause is "improper state validation within the reset-credentials authentication flow," the process Keycloak executes when someone requests password recovery. The company determined the severity to be Critical because an unauthenticated remote attacker can exploit it without requiring any user interaction. As of August 24, 2026, there's no indication the vulnerability has been exploited in the wild, and no confirmed public exploit code has been found. Red Hat credited James Paremain with discovering and reporting the flaw.
The defect resides in how the authentication flow's state is managed, based on Red Hat's bug report. An attacker transmits a specially crafted request to the reset-credentials endpoint, causing the authentication session to jump directly to the password update phase. The action token that Keycloak typically sends through email is never needed. Successful exploitation leads to complete account takeover of any user, "including administrative accounts," by resetting their password. Escape researcher Enzo Mongin, discussing a different Keycloak access-control vulnerability he disclosed in July, noted that an attacker who breaches one of the server's boundaries doesn't stop at Keycloak—"they get into everything sitting behind it."
The vulnerability matters because Keycloak operates as a gatekeeper for identity and access management across entire infrastructures. When an attacker can bypass the password reset mechanism and seize control of administrative accounts without authentication or user interaction, they effectively gain the keys to every system that trusts Keycloak for authentication. For organizations that can't update right away, Red Hat has published a temporary workaround: disable the "Forgot password" functionality across all realms through the RHBK administration console under Realm settings, then Login, then Forgot password. The company emphasized that this setting must be applied to every realm and that customers should upgrade to a fixed version as quickly as possible. CVE-2026-18963 was one of eight CVE identifiers marked as resolved in the Keycloak 26.7.2 release notes, which also addressed CVE-2026-15571, a predictable account-linking hash enabling account takeover through a malicious OpenID Connect client.
Red Hat shipped four errata on August 18, 2026, covering standalone server packages and container images for two RHBK streams. Organizations running Keycloak in production environments should prioritize patching immediately, given the severity rating and the potential for complete infrastructure compromise if administrative accounts fall into attacker hands. The published sources don't clarify whether every realm with the forgotten-password feature enabled is vulnerable, or only certain reset-credentials flow configurations. Security teams managing multi-realm deployments will need to proceed under the assumption that any realm with password recovery enabled is at risk until the patch is applied. Organizations that rely on identity federation face compounded exposure, since a single compromised identity provider can cascade access across multiple downstream services and applications.