{"id":"CVE-2026-18963","published":"2026-08-18T17:05:07Z","modified":"2026-10-23T16:38:40Z","title":"Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass","vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","tier":"core","eol":null,"affectedVersions":[{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","versions":["all versions"]}],"description":{"text":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the reset-credentials flow of the keycloak-services component, the core identity and access management engine in Red Hat build of Keycloak 26.4, lets the process for resetting passwords be bypassed. An unauthenticated remote attacker, with no user interaction required, can force a password reset for any user without completing the email verification step and set new credentials on the target account.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:28Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04682,"percentile":0.91768,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-25","exploitedFirstSeen":"2026-08-25","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-18963","date":"2026-08-25"},{"url":"https://www.linkedin.com/feed/update/urn:li:activity:7498037329845157888/","date":"2026-08-25"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"CVE-2026-18963 Keycloak Unauthenticated Password Reset Account Takeover","url":"https://otx.alienvault.com/pulse/6a8d303334be235463ada684","created":"2026-08-25"}],"provenance":"machine"},"cwes":[{"id":"CWE-640","name":"Weak Password Recovery Mechanism for Forgotten Password"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:56519","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56520","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56523","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56524","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18963","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511595","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-503852.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":[">=26.0.0, <26.4.15",">=26.5.0, <26.6.6",">=26.7.0, <26.7.2"],"patched":["26.4.15","26.6.6","26.7.2"],"from":["GHSA-4gv3-mc9p-5wqc"],"provenance":"source"}],"advisories":[{"id":"GHSA-4gv3-mc9p-5wqc","url":"https://github.com/advisories/GHSA-4gv3-mc9p-5wqc","severity":"CRITICAL","ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":[">=26.0.0, <26.4.15"],"patched":["26.4.15"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4gv3-mc9p-5wqc","url":"https://github.com/advisories/GHSA-4gv3-mc9p-5wqc","severity":"CRITICAL","ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":[">=26.5.0, <26.6.6"],"patched":["26.6.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4gv3-mc9p-5wqc","url":"https://github.com/advisories/GHSA-4gv3-mc9p-5wqc","severity":"CRITICAL","ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":[">=26.7.0, <26.7.2"],"patched":["26.7.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-61063","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61063","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52699,"url":"https://www.exploit-db.com/exploits/52699","title":"Keycloak  26.7.2 - Unauthenticated Account Takeover","type":"webapps","platform":"multiple","date":"2026-10-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-10-21"},"pocGithub":{"count":15,"skipped":3,"earliest":"2026-08-20","earliestUrl":"https://github.com/kyos-public/keycloak-cve-2026-18963-hunt","repos":[{"name":"ynsmroztas/KeySniper","url":"https://github.com/ynsmroztas/KeySniper","stars":120,"created":"2026-09-06"},{"name":"Snizi/CVE-2026-18963-Exploit","url":"https://github.com/Snizi/CVE-2026-18963-Exploit","stars":45,"created":"2026-08-20"},{"name":"Red-Darkin/CVE-2026-18963-keycloak","url":"https://github.com/Red-Darkin/CVE-2026-18963-keycloak","stars":20,"created":"2026-08-24"},{"name":"EQSTLab/CVE-2026-18963","url":"https://github.com/EQSTLab/CVE-2026-18963","stars":18,"created":"2026-09-01"},{"name":"prot0tw/Keycloak_CVE-2026-18963_PoC","url":"https://github.com/prot0tw/Keycloak_CVE-2026-18963_PoC","stars":17,"created":"2026-08-25"}]},"nuclei":[{"id":"CVE-2026-18963","name":"Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass","severity":"critical","path":"http/cves/2026/CVE-2026-18963.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml"}],"first":{"date":"2026-08-20","source":"PoC-in-GitHub","url":"https://github.com/kyos-public/keycloak-cve-2026-18963-hunt"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-08-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-18963","provenance":"source"},{"date":"2026-08-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-10-21","url":"https://github.com/kyos-public/keycloak-cve-2026-18963-hunt","provenance":"source"},{"date":"2026-08-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-18963","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":75.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 67 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.35,"detail":"percentile 0.9177"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 15 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2026-37977","published":"2026-04-06","fixed":"26.6.3","kev":false,"link":{"from":"CVE-2026-37977","to":"CVE-2026-18963","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"26.4.13","toFixed":"26.4.15","daysApart":134}]}},{"cve":"CVE-2026-9799","published":"2026-06-25","fixed":"26.6.4","kev":false},{"cve":"CVE-2026-9800","published":"2026-06-25","fixed":"26.6.4","kev":false},{"cve":"CVE-2026-9088","published":"2026-06-05","fixed":"26.7.0","kev":false,"link":{"from":"CVE-2026-9088","to":"CVE-2026-18963","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"26.7.0","toFixed":"26.7.2","daysApart":74}]}},{"cve":"CVE-2026-18963","published":"2026-08-18","fixed":"26.7.2","kev":false}],"package":"Maven:org.keycloak:keycloak-services"}}