CVE-2026-18963 Overview
A flaw exists in the reset-credentials flow of the keycloak-services component, the core engine for identity and access management in Red Hat Build of Keycloak. The vulnerability allows an unauthenticated attacker to force the password reset process for any user without clicking the required email verification link. Successful exploitation lets attackers directly set new credentials and gain full control over targeted user accounts. Red Hat published advisories RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524 to address the flaw. The weakness is classified under CWE-640: Weak Password Recovery Mechanism for Forgotten Password.
Critical Impact
Unauthenticated attackers can hijack any Keycloak user account by bypassing email verification during the credential reset workflow.
Affected Products
- Red Hat Build of Keycloak
- keycloak-services component
- Red Hat identity and access management deployments referenced in RHSA-2026:56519 through RHSA-2026:56524
Discovery Timeline
- 2026-08-18 - CVE-2026-18963 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-18963
Vulnerability Analysis
The defect resides in the reset-credentials authentication flow within keycloak-services. Keycloak normally issues an email containing a signed action token that a user must click to prove ownership of the account before setting a new password. The vulnerability allows the reset process to progress and finalize new credentials without validating that the email verification step was completed. An unauthenticated remote attacker can therefore submit new password material for any known username or email address. Because the reset action bypasses the ownership proof, the attacker becomes indistinguishable from the legitimate account holder after the reset completes. The confidentiality and integrity impact is high, while availability remains unaffected.
Root Cause
The root cause is a broken step-ordering constraint in the reset-credentials execution graph. The flow trusts intermediate session state and permits credential change without enforcing that the verify-email or equivalent action token step was successfully consumed. This aligns with CWE-640, where the recovery mechanism does not adequately authenticate the requester.
Attack Vector
Exploitation occurs over the network against the Keycloak account console or REST endpoints exposed by the keycloak-services component. No prior authentication, credentials, or user interaction with the victim are required. The attacker enumerates or already knows a target username, initiates the reset flow, and manipulates the sequence to reach the password-set step directly.
No verified public exploit code is available. See the Red Hat CVE-2026-18963 Details and Red Hat Bugzilla Report #2511595 for authoritative technical details.
Detection Methods for CVE-2026-18963
Indicators of Compromise
- Successful UPDATE_PASSWORD events in Keycloak audit logs that are not preceded by a matching VERIFY_EMAIL or EXECUTE_ACTION_TOKEN event for the same user session.
- Multiple RESET_PASSWORD initiations against distinct accounts originating from a single IP address or client identifier in a short window.
- Reset-credentials flow completions where the auth_session shows no email token consumption in keycloak-services traces.
Detection Strategies
- Enable Keycloak event logging for RESET_PASSWORD, RESET_PASSWORD_ERROR, UPDATE_PASSWORD, and SEND_RESET_PASSWORD and correlate the ordering per session ID.
- Alert when password changes complete without a preceding verified action token event in the same authentication session.
- Baseline normal reset volumes per realm and flag statistical anomalies at the realm and client level.
Monitoring Recommendations
- Forward Keycloak realm event logs and admin events to a centralized SIEM for correlation with authentication activity from downstream applications.
- Monitor sudden authentication behavior changes such as new device, new geography, or MFA re-enrollment immediately after a password reset.
- Track anomalous access to Keycloak endpoints under /realms/{realm}/login-actions/reset-credentials and related action-token URLs.
How to Mitigate CVE-2026-18963
Immediate Actions Required
- Apply the updates delivered in RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524 as soon as maintenance windows allow.
- Force a password reset and session revocation for high-value accounts, especially administrators and service accounts, after patching.
- Audit realm event logs for suspicious UPDATE_PASSWORD activity since the exposure window began and investigate any anomalies.
Patch Information
Red Hat has released fixed builds through the Red Hat Build of Keycloak advisories referenced above. Consult the Red Hat CVE-2026-18963 Details page for the exact fixed package versions matching each supported deployment channel.
Workarounds
- Disable the built-in reset-credentials flow at the realm level until the patched version is deployed, and require administrator-driven password resets.
- Restrict network exposure of Keycloak login-actions endpoints to trusted networks or place them behind a web application firewall with rate limiting.
- Require multi-factor authentication on all accounts so that a stolen password alone is insufficient for downstream application access.
# Temporarily disable the built-in reset-credentials flow via kcadm.sh
# Replace REALM with the target realm name
kcadm.sh update realms/REALM -s resetPasswordAllowed=false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
