Identity teams running Keycloak are facing a patch race: the open-source access management server has a critical hole that lets unauthenticated attackers reset any user’s password and seize the account. Red Hat and the upstream Keycloak project shipped fixes this week.
The vulnerability, tracked as CVE-2026-18963, carries a CVSS score of 9.1 and falls under the weak password recovery mechanism class (CWE-640). Red Hat’s analysis points to state-handling errors in the flow that runs when a user requests a new password. The session can be steered straight from the reset request to the password update step, skipping the emailed action token entirely.
Exploitation grants full control of any account, including administrative ones. No in-the-wild abuse has been observed and no public exploit exists as of August 24.
Upstream Keycloak 26.7.2, released August 19, contains the fix, along with Red Hat build of Keycloak 26.4.15 and 26.6.6.
For teams that cannot update right away, Red Hat’s interim fix is blunt: switch off Forgot password in every realm until the patched build is in. The setting lives under Realm settings, Login, then Forgot password in the administration console. Researcher James Paremain reported the flaw.
