| Severity | CRITICAL |
| Threat Category | Vulnerability – Authentication Bypass/ Account Takeover |
| Affected Platforms | Keycloak 26.4.x (before 26.4.15), 26.6.x (before 26.6.6), 26.7.x (before 26.7.2); Red Hat Build of Keycloak (unpatched builds) |
| CVE | CVE-2026-18963 |
| CVSS | 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) |
1. Overview
A critical vulnerability, tracked as CVE-2026-18963, has been disclosed in Keycloak, the widely used open-source identity and access management (IAM) platform that provides single sign-on (SSO) for web applications and services. A flaw in the reset-credentials (“forgot password”) flow of the keycloak-services component allows an unauthenticated, remote attacker to bypass the email verification step of the password reset process and directly set new credentials for any user account ( including administrator accounts) resulting in full account takeover. The flaw is rated 9.1 (Critical) on the CVSS v3.1 scale and is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).
2. Who is Affected
Any organization running an unpatched Keycloak or Red Hat build of Keycloak instance whose login page (specifically the “Forgot password” function) is reachable by an attacker is affected. As of the date of this advisory, BtCIRT has not received any confirmed reports of exploitation against systems in Bhutan, and no in-the-wild exploitation has been publicly confirmed globally.
Despite the absence of confirmed incidents, the severity rating is assessed as CRITICAL because:
- The attack requires no authentication/user interaction/special privileges, only network access to the Keycloak login page.
- Administrator accounts can be taken over, and Keycloak typically fronts many downstream applications, so a single compromise can cascade across an organization’s entire SSO estate.
- NVD SSVC analysis rates the vulnerability as automatable, meaning it can be exploited at scale without manual effort.
- Public detection tooling and technical write-ups describing the flaw are already available, lowering the bar for attackers to develop working exploits.
- Keycloak is commonly deployed as the central identity provider in government, enterprise, and education environments.
3. How the [Threat/Vulnerability/Attack] Works
- Root Cause (Stage 1): Improper state validation in Keycloak’s reset-credentials flow incorrectly marks emails as verified and advances the session before required link verification occurs.
- Exploitation (Stage 2): Unauthenticated attackers initiate a password reset for any target user and manipulate the flow to bypass email link verification entirely, requiring zero interaction or mailbox access from the victim.
- Impact (Stage 3): Full account takeover—including administrative accounts and SSO-connected applications—with a side effect of automatically setting the victim’s email status to “verified” in the database.
- Remediation & Timeline (Stage 4): Discovered by James Paremain and patched on August 19, 2026. Upgrade immediately to Keycloak 26.4.15 (LTS), 26.6.6, 26.7.2, or 26.8.0 (or RHBK equivalents). Also resolves related account-linking flaw CVE-2026-15571.
4. Indicators to Watch For
- Your Keycloak version is older than the fixed release for its stream: 26.4.15 (LTS), 26.6.6, 26.7.2, or 26.8.0. All earlier versions in supported streams are vulnerable.
- Accounts whose email_verified attribute changed to true with no corresponding VERIFY_EMAIL or UPDATE_EMAIL event and no admin operation on the account – the most deterministic in-database trace of exploitation.
- UPDATE_PASSWORD or UPDATE_CREDENTIAL events that share a code_id with a SEND_RESET_PASSWORD event, or credential changes recorded despite a NO_MAIL_WAS_SENT (failed email delivery) condition.
- Password resets that complete with no matching ‘GET /realms/<realm>/login-actions/action-token?key=…’ request in web access logs. A legitimate reset always shows this request between the email being sent and the password change.
- Users reporting unexpected “your password was changed” notifications, unsolicited password-reset emails, or sudden inability to log in to SSO-protected services.
5. Recommendations
5.1. For organizations and government offices:
- Upgrade immediately to a fixed release: Keycloak 26.4.15, 26.6.6, 26.7.2, or 26.8.0 (or the corresponding patched Red Hat Build of Keycloak images). Review the Keycloak migration guide before upgrading production realms.
- If you cannot patch immediately, disable self-service password recovery across all realms:Realm settings → Login → Forgot password → Off. While disabled, administrators must process password resets manually. Re-enable this setting only after all Keycloak cluster nodes are upgraded.
- Hunt for past exploitation across the full exposure window using the indicators in Section 4 and the Kyos SQL script; correlate Keycloak event logs with web access logs.
- For any account showing suspicious traces, force a password reset, revoke all active sessions and tokens, and review actions taken by that account — especially administrator accounts.
- Enforce multi-factor authentication (MFA/2FA) in Keycloak, particularly for administrators as MFA limits what an attacker can do with stolen credentials alone.
- Restrict access to the Keycloak admin console to trusted networks, and avoid exposing realms’ login endpoints to the internet where not required.
5.2. For individuals (if applicable):
- If you receive a password-reset or “password changed” email for an organizational SSO account that you did not request, do not ignore it — report it to your IT team immediately.
- If you are suddenly unable to log in to your organization’s services, treat it as a possible account takeover rather than a forgotten password.
- Enable multi-factor authentication on your accounts wherever it is offered.
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt
7. Sources and References
- Keycloak Project – CVE-2026-18963: Unauthenticated account takeover via reset-credentials flow bypass (GitHub issue #51833), 18 August 2026: https://github.com/keycloak/keycloak/issues/51833
- Red Hat Customer Portal – CVE-2026-18963, August 2026: https://access.redhat.com/security/cve/cve-2026-18963
- SecurityOnline – CVE-2026-18963: Unauthenticated Account Takeover Flaw Hits Keycloak, 21 August 2026:
https://securityonline.info/keycloak-account-takeover-cve-2026-18963/ - Kyos – keycloak-cve-2026-18963-hunt: forensic hunting queries for CVE-2026-18963 exploitation traces, August 2026:
https://github.com/kyos-public/keycloak-cve-2026-18963-hunt