- The Mess: A critical vulnerability in Keycloak, CVE-2026-18963, allows an unauthenticated attacker to force a password reset for another user and set a new password without completing the required email verification step. The flaw has a CVSS score of 9.1 and can result in complete account takeover.
This is an identity server.
That’s the problem.
Keycloak is commonly deployed as the authentication layer sitting in front of other applications, APIs and internal services. Compromise the identity layer and you don’t necessarily get one account.
You can get the keys to everything behind it.
The vulnerability sits in Keycloak’s password-reset flow.
Normally, a user requests a password reset.
Keycloak sends an email.
The user follows the action link.
Only then should the password be changed.
CVE-2026-18963 breaks that logic.
An attacker can manipulate the reset process and bypass the required email verification, allowing them to directly set new credentials for the targeted account.
No password.
No stolen mailbox.
No victim clicking the reset email.
That’s a serious authentication failure.
And administrator accounts are particularly interesting targets.
Take over a normal application account and you’ve got a problem.
Take over the identity administrator and you’ve potentially got a completely different problem.
- The Damage: An unauthenticated attacker can potentially take over arbitrary Keycloak accounts, including privileged accounts, and then use those credentials to access applications and services trusting the compromised identity provider.
This is where Keycloak becomes more dangerous than an ordinary web application.
It’s an identity provider.
Other systems trust it.
Applications may redirect users to Keycloak for authentication and accept the resulting tokens as proof of identity.
If the attacker controls the Keycloak account, those downstream applications may simply see:
Valid user.
Nothing obviously suspicious.
The attacker doesn’t need to crack a password.
They don’t need to steal a session cookie.
They just replace the password.
And if the victim is an administrator?
The attacker may suddenly inherit the administrator’s access across every application connected to that Keycloak deployment.
That’s a much bigger blast radius than the vulnerable component initially suggests.
CISA’s enrichment for the CVE also rates the potential technical impact as total, while noting that exploitation was considered automatable.
This is why identity infrastructure deserves a different level of paranoia.
One vulnerable application can compromise one application.
A vulnerable authentication server can compromise trust itself.
- The Fix: Upgrade Keycloak immediately to a fixed release — including 26.4.15, 26.6.6 or 26.7.2 depending on your branch — and temporarily disable the “Forgot password” functionality if you cannot patch immediately.
After patching, don’t stop there.
Review password-reset activity.
Look for unexpected resets.
Pay particular attention to administrator accounts.
Check for new credentials or suspicious authentication activity following password-reset requests.
If you discover evidence that an account was taken over, resetting the password alone may not be enough. Revoke active sessions and credentials/tokens where appropriate, then investigate what the compromised identity accessed.
And remember that a patched Keycloak server does not automatically mean previously compromised accounts are safe.
The vulnerability could have been exploited before the update.
Bugstoday Opinion
This is a nasty one.
Not because the exploit requires some exotic memory corruption.
Quite the opposite.
The attacker simply tells the identity system:
“Reset this user’s password.”
And the system can be tricked into trusting them.
That’s an authentication failure at the layer where authentication is supposed to be the whole point.
The scary scenario isn’t someone taking over a random Keycloak account.
It’s an attacker finding an administrator account and turning one broken password-reset workflow into access across an entire SSO environment.
Bugstoday verdict: if Keycloak is your identity gatekeeper, CVE-2026-18963 deserves immediate attention. An authentication server that lets strangers reset your password without proving who they are isn’t a security boundary anymore.
