Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)
Keycloak / Red Hat Build of Keycloak (keycloak-services)
A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.
Why this severity: CVSS 9.1 (Red Hat); unauthenticated takeover of any account; public PoC on Exploit-DB since Oct 21 2026; no confirmed in-the-wild exploitation reported
- Started
- Oct 21, 2026
Affected
- org.keycloak:keycloak-services >= 26.0.0, < 26.4.15
- >= 26.5.0, < 26.6.6
- >= 26.7.0, < 26.7.2
Fixed in
- 26.4.15
- 26.6.6
- 26.7.2
- 26.8.0 and later
Timeline2
Exploit-DB publishes EDB-52699 "Keycloak 26.7.2 - Unauthenticated Account Takeover" by Abel Maldonado (Orevim): a PoC with a safe --check mode and a --set-password takeover mode, tested on Keycloak 26.6.2.
SourceCVE-2026-18963 published with GitHub advisory GHSA-4gv3-mc9p-5wqc (critical); fixed in keycloak-services 26.4.15, 26.6.6 and 26.7.2, with Red Hat errata for Red Hat Build of Keycloak.
Source
Advisories4
Posts1
[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover dlvr.it/TW0wH6
Notes & caveats
Exploit-DB title names 26.7.2 but the PoC header and GHSA list 26.7.2 as the fixed release; affected ranges above are from the advisory.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
