Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Exploits & proofs of concept
- exploit-dbKeycloak 26.7.2 - Unauthenticated Account Takeoverby Abel Maldonado
- nucleiKeycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypassby DhiyaneshDk
News coverage
- Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any AccountThe Hacker News · 8/24/2026
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:56519
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:56520
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:56523
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:56524
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-18963
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2511595
Updated 25m ago · 8 sources