Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Summary
| CVE | CVE-2026-18963 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-18 17:16:57 UTC |
| Updated | 2026-09-08 09:17:43 UTC |
| Description | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.003910000 probability, percentile 0.324170000 (date 2026-08-23)
Problem Types: CWE-640 | CWE-640 Weak Password Recovery Mechanism for Forgotten Password
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4.15-1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-23 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-23 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4.15 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4.15 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6.6-1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-12 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-12 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6.6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6.6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6.6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | Not specified | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7 | Not specified | Not specified |
| ADP | Siemens | Industrial Edge Management Cloud | affected * custom | Not specified |
| ADP | Siemens | Industrial Edge Management Pro V1 | affected V1.14.9 V1.15.20 custom | Not specified |
| ADP | Siemens | Industrial Edge Management Pro V2 | affected V2.2.0 V2.2.2 custom | Not specified |
| ADP | Siemens | Industrial Edge Management Virtual | affected V2.6.0 V2.9.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:56523 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:56520 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:56519 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-18963 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| cert-portal.siemens.com/productcert/html/ssa-503852.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| access.redhat.com/errata/RHSA-2026:56524 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank James Paremain for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-31T15:46:15.000Z | Reported to Red Hat. |
| CNA | 2026-08-17T00:00:00.000Z | Made public. |
Workarounds
CNA: If an immediate upgrade is not possible, disabling the "Forgot password" functionality across all realms can be used as a temporary mitigation. In the RHBK administration console, navigate to: Realm settings → Login → Forgot password → Off Apply this setting to all realms. Upgrade to a fixed version as soon as possible.
There are currently no legacy QID mappings associated with this CVE.