Red Hat has disclosed a critical flaw in Keycloak, the widely deployed open-source identity and access management platform, that let unauthenticated attackers take over any user account, including administrator accounts, without ever touching the target’s inbox.
What happened
The vulnerability, tracked as CVE-2026-18963, scores 9.1 on CVSS v3 and stems from improper state validation in Keycloak’s reset-credentials authentication flow. Normally, resetting a password requires clicking an action link sent to the account’s registered email. The flaw let an attacker send specially crafted requests that jumped the session straight to the password-update step, skipping the email verification entirely. The result: full account takeover on demand, with no phishing, no credential theft and no user interaction required. Red Hat credited researcher James Paremain with the report and patched upstream Keycloak (26.7.2) on August 19, with Red Hat Build of Keycloak versions 26.4.15 and 26.6.6 following a day earlier.
Why it matters
Keycloak sits in front of authentication for a large share of enterprise single sign-on deployments, which makes an unauthenticated, zero-interaction account-takeover bug in its password-reset flow a direct path to every application behind it, not just one login page. Because the flaw requires no phishing or user error, the usual defenses, security training, MFA prompts a user would notice, do not help until the patch lands. An unpatched instance stays exposed as long as the reset-credentials flow is enabled.
The original angle
The disclosure lands as CISA’s known-exploited-vulnerabilities catalog keeps filling with identity-layer bugs rather than classic remote-code-execution flaws, a shift CyberTech has tracked in recent coverage of authentication infrastructure. What stands out is the interim workaround Red Hat recommends before patching everywhere: disabling “Forgot password” entirely in the admin console, realm by realm. That usability regression is the price of closing an account-takeover hole, and a reminder that identity providers deserve the same patch urgency as internet-facing edge devices, not the lower priority backend software often gets.
Related coverage: AI Agents Are an Identity Problem, and Most Enterprises Are Pretending Otherwise.
Source: Red Hat
