Red Hat · Public exploit code

Keycloak patches unauthenticated account takeover; public exploit available

Oct 20, 2026 · 1 min read

CVE-2026-18963 in Keycloak lets an unauthenticated attacker take over any account by forcing a password reset without clicking the email verification link. Red Hat rated the flaw Critical (CVSS 9.1) and a public proof of concept has been on Exploit-DB since October 21, 2026. Upgrade to 26.4.15, 26.6.6, 26.7.2 or 26.8.0 and later; as a temporary mitigation, disable the password recovery feature in all realms.

By HIFY Radar newsroom Updated 10/26/2026 01:17 PM Get this every day →← Back to the feed 4 sources

CriticalVulnerabilityPublic exploit codePatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Keycloak has fixed a critical flaw (CVE-2026-18963) that lets a remote attacker, unauthenticated and with no victim interaction, take over any user account by setting a new password without the email verification step. A public proof of concept is on Exploit-DB. Red Hat rated the risk Critical, CVSS 9.1.

Why it matters

Organizations running Keycloak or Red Hat Build of Keycloak on affected 26.x versions have accounts, including administrators, exposed to remote takeover by anyone who can reach the server. The attacker sets a new password, locks out the legitimate owner, and reaches every system tied to this central login.

What to do

Upgrade immediately to 26.4.15, 26.6.6, 26.7.2 or 26.8.0 and later. If upgrading is not possible right now, disable the Forgot password feature in all realms (Realm settings, Login, Forgot password, Off) as a temporary mitigation.

For the technical team

CVE: CVE-2026-18963
Affected: Red Hat (Keycloak) Keycloak / Red Hat Build of Keycloak (keycloak-services) · org.keycloak:keycloak-services 26.0.0 through 26.4.14; 26.5.0 through 26.6.5; 26.7.0 through 26.7.1 (GHSA).
Exploitation: Public PoC on Exploit-DB (EDB-52699, dated 2026-10-21, author Abel Maldonado, Orevim), with code also in the GitHub repository orevim/CVE-2026-18963-PoC. Tested on Keycloak 26.6.2 in Docker (quay.io/keycloak/keycloak:26.6.2). The sources report no real-world exploitation.
Fix: Fixed versions: 26.4.15, 26.6.6, 26.7.2; the 26.8.0 line ships with the fix. Red Hat temporary mitigation: disable Forgot password in all realms (RHBK administration console, Realm settings, Login, Forgot password, Off).
Vector: Component keycloak-services, the core identity and access management engine of Red Hat Build of Keycloak. Improper state validation in the reset-credentials flow (CWE-640). Per the PoC, an unscoped AUTHENTICATION_SELECTOR_SCREEN_DISPLAYED note lets an unauthenticated caller re-render the authenticator selection screen bound to the email execution; that execution's action handler sets emailVerified and calls success without checking the action token, so the flow reaches the update-password required action with no emailed link. Red Hat: network vector, no privileges, no user interaction, low complexity (CVSS 9.1).
More details: Red Hat assessed severity as Critical with CVSS v3 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), same vector at cve.org. Issue reported to Red Hat by James Paremain. References: Bugzilla 2511595, GHSA-4gv3-mc9p-5wqc. The PoC has three modes: --check (tests whether the instance is affected, sending no mail and changing no account), --check --users (reports which identifiers resolve; on an affected build it sets emailVerified as a side effect) and --set-password (completes the takeover and locks the account holder out). Endpoints come from the realm's OIDC discovery document and fields from the forms themselves, so custom themes, paths and field names work without edits.