CVE-2026-18963
CVE-2026-18963 is a weak password-recovery mechanism vulnerability (CVSS 9.1, CWE-640) in the Keycloak open-source identity and access management server. An unauthenticated remote attacker can take over arbitrary accounts by forcing password resets through improper state validation in the reset-credential flow.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-18963 |
| Product | Keycloak (Red Hat build of Keycloak / RHBK also affected) |
| CVSS | 9.1 (Critical) |
| Weakness | CWE-640 — weak password-recovery mechanism |
| Impact | Unauthenticated account takeover via forced password reset |
| Fixed releases | Keycloak 26.7.2; RHBK 26.4.15 and 26.6.6 |
| Exploitation | No evidence of exploitation or public exploit as of 2026-08-24 |
Remediation
Upstream fixes shipped in Keycloak 26.7.2 (released 19 August 2026), with RHBK builds 26.4.15 and 26.6.6 also patched. Given Keycloak's role guarding enterprise single sign-on, defenders should treat patching as urgent before a weaponised chain appears.
Australian Context
Open-source identity infrastructure such as Keycloak is common across federal and state government shared services in Australia. An unauthenticated reset-to-takeover path is the kind of bug that gets chained once public exploits appear, making early patching worthwhile despite the absence of observed exploitation.
Source
Related
- Keycloak Cve 2026 18963 Critical Password Reset Flaw 2026 08 24 — disclosure incident note