Authentication bypass affecting Keycloak
A vulnerability affecting Keycloak would allow an unauthenticated malicious actor to force a password reset of any user and take full control of the targeted account.
Description
Technical context and vulnerability details
Keycloak is an open source identity and access management (IAM) solution, widely used to centralize the authentication of multiple applications behind a single identity provider. This tool is affected by a vulnerability labeled CVE-2026-18963, resulting from a defect in the password reset flow (reset-credentials) of the keycloak-services component. This defect allows the server to wrongly consider the email validation step as completed, when it never was. Exploitation of this vulnerability would allow an unauthenticated attacker to force a password reset for any user, without needing to click the emailed verification link, and directly set new credentials. This vulnerability is classified critical with a severity score of 9.1 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Total takeover of user accounts;
- Bypassing email verification during password reset;
- Breach of confidentiality, integrity and availability of data;
Affected systems
Products, components and targeted versions
- Keycloak versions prior to 26.7.2, 26.6.6 and 26.4.15 depending on the branch used;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Keycloak to version 26.7.2, 26.6.6 or 26.4.15 depending on the branch used. Otherwise, temporarily disable the password reset functionality across all realms;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.