A critical flaw in Keycloak, one of the most widely used open source tools for handling logins and single sign-on across web applications, could have let an attacker take over any user account, including administrator accounts, without needing a password or access to the victim’s email inbox.
The vulnerability, tracked as CVE-2026-18963, carries a CVSS score of 9.1 out of 10, placing it in the critical severity range. It affects the “reset-credentials” flow, the part of Keycloak that handles forgotten-password requests. Normally, that flow works by emailing the user a special link, called an action token, which they have to click before they are allowed to set a new password. According to the technical writeup covered by The Hacker News, the flaw allowed an attacker to send a specially crafted request directly to the reset-credentials endpoint and have the authentication session jump straight to the password update step, skipping the email verification step entirely. In effect, anyone who knew or guessed a username could reset that account’s password without ever touching the victim’s inbox.
Who is affected
The flaw affects upstream Keycloak versions before 26.7.2, as well as Red Hat build of Keycloak 26.4 before 26.4.15 and 26.6 before 26.6.6. Red Hat credited security researcher James Paremain with reporting the issue. Fixes are available now: Keycloak 26.7.2 was released on August 19, 2026, and Red Hat has shipped the corresponding 26.4.15 and 26.6.6 builds.
As of the article’s publication on August 24, 2026, no public proof-of-concept exploit had been located and there was no evidence the flaw had been exploited in the wild. That is a meaningfully better starting position than many critical vulnerabilities get, but it also tends to be temporary once a fix is public, since attackers frequently reverse-engineer patches to figure out what was broken.
What organizations should do
Because Keycloak sits at the center of authentication for many organizations, running it as the front door for dozens or hundreds of connected applications, a full account takeover bypass here has outsized consequences compared to a similar bug in a single standalone app. Anyone running a vulnerable version should patch as soon as possible. For deployments that cannot patch immediately, disabling the “Forgot password” feature across all realms removes the vulnerable code path entirely until the upgrade can be completed. Administrators should also review recent password reset activity in their Keycloak logs for anything unusual, particularly resets on privileged or administrative accounts that were not initiated by the account owner.
