Reported by 2 outlets

Timeline

1. original reporting

   Critical Red Hat Keycloak Password Reset Flaw Enables Unauthenticated Account Takeover

   gbhackers.com · 49d ago · August 25th, 2026

   Red Hat has disclosed a critical vulnerability in the Red Hat Build of Keycloak that allows an unauthenticated remote attacker to bypass a key safeguard in the password reset process and seize control of arbitrary user accounts. Tracked as CVE-2026-18963, the flaw affects the keycloak-services component, the core identity and access management engine behind the […] The post Critical Red Hat Keycloak Password Reset Flaw Enables Unauthenticated Account Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Red Hat Keycloak Password Reset Flaw Enables Unauthenticated Account Takeover

   cyberpress.org · 49d ago · August 25th, 2026

   Tracked as CVE-2026-18963, the flaw stems from a bypass in the password-reset workflow and carries a CVSS v3.1 score of 9.1 out of 10. Red Hat Keycloak Password Reset Flaw According to Red Hat, an attacker can trigger the reset-credentials process for a chosen account and set a new password without completing the required email verification step. This would give the attacker control of the victim’s account without credentials, prior access, or user interaction. CVE-2026-18963 is rooted in improper state validation in Keycloak’s reset-credentials authentication flow. Password recovery mechanisms normally rely on a time-limited, single-use verification link delivered to an account’s registered email address. That link is intended to prove that the person requesting a password change controls the associated mailbox. Red Hat classified the issue as CWE-640, “Weak Password Recovery Mechanism for Forgotten Password,” a weakness category that covers recovery flows that can grant unauthorized access or