CVE-2026-18963 is a critical security vulnerability in Keycloak, a widely used open-source Identity and Access Management (IAM) platform for modern applications and services.
The vulnerability resides in the reset-credentials flow within the keycloak-services component. It allows an unauthenticated attacker to bypass the email verification step during the password recovery process.
If successfully exploited, an attacker can directly set new credentials and achieve Account Takeover (ATO) of the targeted account, including high-privileged administrator accounts.
Red Hat has rated CVE-2026-18963 as Critical, assigning it a CVSS 3.1 score of 9.1. The CVSS vector is:
text
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
This indicates that the attack can be executed over the network with low complexity, requiring no prior privileges and no user interaction.
What is CVE-2026-18963?
CVE-2026-18963 is a flaw in Keycloak's password recovery / reset credentials mechanism.
Typically, the password recovery process works as follows:
text
User ──► Forgot Password ──► Keycloak ──► Generate reset request ──► Email ──► Verification link ──► User clicks ──► Password Reset
The email verification step is crucial as it proves the user requesting the reset actually owns the account's email address. However, CVE-2026-18963 stems from improper state validation within the reset-credentials flow, allowing an attacker to completely bypass this verification step.
Why is this vulnerability so dangerous?
This is not a mere information disclosure bug. The real danger lies in its potential for Account Takeover (ATO).
Attack scenario:
text
Attacker ──► Password Recovery ──► Keycloak ──► Reset Flow Bypass ──► Email Verification Bypassed ──► Set New Credentials ──► Victim Account Taken Over
If the compromised account possesses high privileges (e.g., an Admin account), the attacker could pivot and gain unauthorized access to downstream applications, internal APIs, databases, and core enterprise systems.
Quick Facts about CVE-2026-18963
Attribute Details
CVE ID CVE-2026-18963
Product Keycloak (keycloak-services)
Vulnerability Authentication / Password Recovery Bypass
CWE CWE-640 (Weak Password Recovery Mechanism)
Severity Critical
CVSS 3.1 9.1
Primary Impact Account Takeover (ATO)
Why MFA might not protect you
Multi-Factor Authentication (MFA) provides excellent protection for the standard login flow. However, CVE-2026-18963 occurs in the Password Recovery flow, completely bypassing the initial login screen. If an attacker successfully bypasses the email verification and sets a new password, they control the new credentials. Therefore, relying solely on MFA does not mitigate the risks posed by CVE-2026-18963.
Affected Versions
According to Red Hat advisories, updates are available for the Red Hat Build of Keycloak 26.4 and 26.6 branches.
Safe, patched versions: 26.4.15 and 26.6.6. For environments utilizing upstream Keycloak or container images (e.g., quay.io/keycloak/keycloak), administrators must cross-reference their specific versions with vendor security advisories.
Mitigation and Remediation
1. Upgrade Keycloak (Prioritized)
The recommended remediation is to upgrade your Keycloak deployment to a patched version provided by your vendor (e.g., 26.4.15 or 26.6.6).
2. Temporary Mitigation: Disable "Forgot Password"
If an immediate upgrade is not feasible, Red Hat recommends a highly effective temporary workaround: Disable the Forgot Password feature across all realms. Navigate to: Keycloak Administration Console → Realm settings → Login → Toggle Forgot password to Off.
3. Review Logs and Audit Accounts
Applying a patch or mitigation does not guarantee that your system hasn't already been compromised. Administrators should actively hunt for anomalies:
Password reset requests from unusual IP addresses.
Unexpected modifications to user credentials, emails, or Role/Group assignments.
The creation of new administrative or service accounts.
Security Takeaway: Password recovery is a critical security boundary. A system with strong passwords and robust MFA can still fall victim to Account Takeover if its password-reset mechanism is flawed. Always treat identity recovery flows as security-critical operations.
