Critical Keycloak Vulnerability Enables Instant Unauthenticated Account Takeover (CVE-2026-18963)

A critical security vulnerability patched across the open-source Keycloak project and Red Hat build of Keycloak (RHBK) has put enterprise identity management on high alert. Designated as CVE-2026-18963 with a near-maximum CVSS severity score of 9.1, the flaw allows unauthenticated remote attackers to completely hijack any user account—including global administrator accounts—by manipulating the application’s native password recovery framework.

  Attacker Request               Keycloak Authentication State              Result
+------------------+           +-------------------------------+    +-------------------+
| Crafted HTTP     | --------> | State Validation Bypassed     | -> | Direct Password   |
| Reset Request    |           | (Action Token Skipped)        |    | Reset & Takeover  |
+------------------+           +-------------------------------+    +-------------------+

Technical Root Cause

The vulnerability stems from a fundamental logic error categorized under CWE-640: Weak Password Recovery Mechanism. Under standard operating conditions, when a user requests a credential reset through Keycloak, the system initiates the reset-credentials workflow, sending a cryptographically signed, single-use action token to the user’s registered email address. The user must click this link to validate their identity before the authentication state transitions to the password update screen.

However, researchers discovered improper state validation within the reset-credentials execution pipeline. By sending a specially crafted HTTP request directly to the reset endpoint, an attacker can trick the internal state engine into jumping straight to the password update phase without ever validating the required action token. Because no email verification or user interaction is enforced, an attacker knowing only a targeted user’s username or email address can overwrite the credential store in real time.

Enterprise Blast Radius

Keycloak is one of the most widely deployed open-source Identity and Access Management (IAM) systems in modern enterprise architecture, serving as the central authentication broker for microservices, Kubernetes clusters, customer-facing web applications, and corporate Single Sign-On (SSO) gateways.

• Administrative Hijacking: Because the vulnerability applies universally across all user roles, compromise of top-level administrative accounts grants total control over security realms, client applications, user databases, and connected OpenID Connect (OIDC) or SAML federations.

• Automation Risk: Because the exploit relies on direct HTTP state manipulation, malicious actors can easily script high-speed automated attacks to attempt mass account takeovers across publicly exposed Keycloak instances.

Mitigation & Strategic Defense

Although no widespread active exploitation was verified prior to disclosure, patch deployment must be prioritized immediately due to the public availability of technical advisory details.

• Apply Patches Urgently: Upstream Keycloak users must immediately update to version 26.7.2 or later. Organizations running Red Hat build of Keycloak should apply updates for the 26.4.15 and 26.6.6 streams.

• Implement Temporary Rate Limiting: Where immediate upgrades are blocked by change freeze windows, security teams should enforce strict rate-limiting and Web Application Firewall (WAF) filtering on all /auth/realms/{realm}/login-actions/reset-credentials URI patterns.

• Audit Authentication Logs: Security Operations Center (SOC) teams should hunt for suspicious HTTP POST requests directed at credential reset endpoints that lack corresponding outbound SMTP mail dispatches or normal session cookie flows.