CVE-2026-18963: fallo crítico en Red Hat build of Keycloak 26.4
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Publicada el · Actualizada el
90Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.1epss 3.2%
de la publicación al arma2 días
Publicada en NVD18 ago
1ª PoC+2d
VulnCheck+7d
probabilidad de explotación
3.2%top 12% de las CVE
explotación observada
síVulnCheck
32 exploit(s) público(s)
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Red Hat · Red Hat build of Keycloak 26.4Red Hat · Red Hat build of Keycloak 26.4.15Red Hat · Red Hat build of Keycloak 26.6Red Hat · Red Hat build of Keycloak 26.6.6Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Single Sign-On 7PoCs públicas encontradas — 32
githubgithub.com/ynsmroztas/KeySniper★ 114githubgithub.com/Snizi/CVE-2026-18963-Exploit★ 46githubgithub.com/Red-Darkin/CVE-2026-18963-keycloak★ 20githubgithub.com/EQSTLab/CVE-2026-18963★ 18githubgithub.com/kyos-public/keycloak-cve-2026-18963-hunt★ 16githubgithub.com/prot0tw/Keycloak_CVE-2026-18963_PoC★ 15githubgithub.com/alt3kx/CVE-2026-18963★ 4githubgithub.com/T0w0T/POC-CVE-2026-18963★ 4githubgithub.com/0xlyvio/CVE-2026-18963-keycloak★ 3githubgithub.com/debugactiveprocess/CVE-2026-18963★ 1githubgithub.com/gman0x00/keycloak-CVE-2026-18963★ 1githubgithub.com/M4xSec/My-Exploits★ 1githubgithub.com/BlackHatExploitation/Exploit-For-CVE-2026-18963★ 0githubgithub.com/ivanesk315/CVE-2026-18963★ 0githubgithub.com/minh3102011/CVE-2026-18963_analyst★ 0githubgithub.com/SonOfABot/-CVE-2026-18963-POC★ 0githubgithub.com/hardeep-sudo/Keycloak-CVE-2026-18963-Exploit★ 0vulncheckvulncheck.com/xdb/82f7f2fbf9c2no verificadovulncheckvulncheck.com/xdb/cb3a9af4320dno verificadovulncheckvulncheck.com/xdb/1c49e3a88c21no verificadovulncheckvulncheck.com/xdb/ec09fd0acac4no verificadovulncheckvulncheck.com/xdb/566b5b03ca0bno verificadovulncheckvulncheck.com/xdb/31478ab97c5bno verificadovulncheckvulncheck.com/xdb/fca7b2181f1fno verificadovulncheckvulncheck.com/xdb/8d4ea1ef5768no verificadovulncheckvulncheck.com/xdb/94b387932385no verificadovulncheckvulncheck.com/xdb/608250488552no verificadovulncheckvulncheck.com/xdb/9edd7646d867no verificadovulncheckvulncheck.com/xdb/ca3c431e711bno verificadovulncheckvulncheck.com/xdb/a770e13ef546no verificadovulncheckvulncheck.com/xdb/6d11262b516ano verificadovulncheckvulncheck.com/xdb/c1b151495bd9no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Red Hat build of Keycloak 26.4
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-7507HIGHOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverEPSS 1.1%CVE-2026-7307HIGHKeycloak: keycloak: denial of service via specially crafted saml inputEPSS 1.0%CVE-2026-9801MEDIUMKeycloak: keycloak: denial of service via malformed ldap password policy responseEPSS 0.9%CVE-2026-3047HIGHOrg.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginEPSS 0.9%CVE-2026-4634HIGHKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersEPSS 0.9%CVE-2026-74909HIGHKeycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segmentsEPSS 0.8%
Referencias
https://access.redhat.com/errata/RHSA-2026:56519https://access.redhat.com/errata/RHSA-2026:56520https://access.redhat.com/errata/RHSA-2026:56523https://access.redhat.com/errata/RHSA-2026:56524https://access.redhat.com/security/cve/CVE-2026-18963https://bugzilla.redhat.com/show_bug.cgi?id=2511595https://cert-portal.siemens.com/productcert/html/ssa-503852.html