CVE-2026-18963
Critical
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
SeverityCritical
CVSS9.1
Exploit probability92. percentile4.7%
ProductOrg.keycloak:keycloak-services
PublishedAug 18, 2026
First seenAug 18, 2026
Weakness typeCWE-640CWE-640
How to fix
Update
- org.keycloak:keycloak-services26.4.15, 26.6.6, 26.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.keycloak:keycloak-servicesMaven | 26.0.0 ≤ v < 26.4.15, 26.5.0 ≤ v < 26.6.6, 26.7.0 ≤ v < 26.7.2 | 26.4.15, 26.6.6, 26.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.