CVE-2026-18963: critical vulnerability in Red Hat build of Keycloak 26.4
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Published · Updated
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.1epss 3.2%
from disclosure to weapon2 days
Published on NVDAug 18
1st PoC+2d
VulnCheck+7d
exploitation probability
3.2%top 12% of all CVEs
observed exploitation
yesVulnCheck
32 public exploit(s)
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Red Hat · Red Hat build of Keycloak 26.4Red Hat · Red Hat build of Keycloak 26.4.15Red Hat · Red Hat build of Keycloak 26.6Red Hat · Red Hat build of Keycloak 26.6.6Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Single Sign-On 7public PoCs found — 32
githubgithub.com/ynsmroztas/KeySniper★ 114githubgithub.com/Snizi/CVE-2026-18963-Exploit★ 46githubgithub.com/Red-Darkin/CVE-2026-18963-keycloak★ 20githubgithub.com/EQSTLab/CVE-2026-18963★ 18githubgithub.com/kyos-public/keycloak-cve-2026-18963-hunt★ 16githubgithub.com/prot0tw/Keycloak_CVE-2026-18963_PoC★ 15githubgithub.com/alt3kx/CVE-2026-18963★ 4githubgithub.com/T0w0T/POC-CVE-2026-18963★ 4githubgithub.com/0xlyvio/CVE-2026-18963-keycloak★ 3githubgithub.com/debugactiveprocess/CVE-2026-18963★ 1githubgithub.com/gman0x00/keycloak-CVE-2026-18963★ 1githubgithub.com/M4xSec/My-Exploits★ 1githubgithub.com/BlackHatExploitation/Exploit-For-CVE-2026-18963★ 0githubgithub.com/ivanesk315/CVE-2026-18963★ 0githubgithub.com/minh3102011/CVE-2026-18963_analyst★ 0githubgithub.com/SonOfABot/-CVE-2026-18963-POC★ 0githubgithub.com/hardeep-sudo/Keycloak-CVE-2026-18963-Exploit★ 0vulncheckvulncheck.com/xdb/82f7f2fbf9c2unverifiedvulncheckvulncheck.com/xdb/cb3a9af4320dunverifiedvulncheckvulncheck.com/xdb/1c49e3a88c21unverifiedvulncheckvulncheck.com/xdb/ec09fd0acac4unverifiedvulncheckvulncheck.com/xdb/566b5b03ca0bunverifiedvulncheckvulncheck.com/xdb/31478ab97c5bunverifiedvulncheckvulncheck.com/xdb/fca7b2181f1funverifiedvulncheckvulncheck.com/xdb/8d4ea1ef5768unverifiedvulncheckvulncheck.com/xdb/94b387932385unverifiedvulncheckvulncheck.com/xdb/608250488552unverifiedvulncheckvulncheck.com/xdb/9edd7646d867unverifiedvulncheckvulncheck.com/xdb/ca3c431e711bunverifiedvulncheckvulncheck.com/xdb/a770e13ef546unverifiedvulncheckvulncheck.com/xdb/6d11262b516aunverifiedvulncheckvulncheck.com/xdb/c1b151495bd9unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Red Hat build of Keycloak 26.4
In the same product, most dangerous first.
CVE-2026-7507HIGHOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverEPSS 1.1%CVE-2026-7307HIGHKeycloak: keycloak: denial of service via specially crafted saml inputEPSS 1.0%CVE-2026-9801MEDIUMKeycloak: keycloak: denial of service via malformed ldap password policy responseEPSS 0.9%CVE-2026-3047HIGHOrg.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginEPSS 0.9%CVE-2026-4634HIGHKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersEPSS 0.9%CVE-2026-74909HIGHKeycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segmentsEPSS 0.8%
References
https://access.redhat.com/errata/RHSA-2026:56519https://access.redhat.com/errata/RHSA-2026:56520https://access.redhat.com/errata/RHSA-2026:56523https://access.redhat.com/errata/RHSA-2026:56524https://access.redhat.com/security/cve/CVE-2026-18963https://bugzilla.redhat.com/show_bug.cgi?id=2511595https://cert-portal.siemens.com/productcert/html/ssa-503852.html