# Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963) · pwn.watch

> A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.

Page: https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover · generated 2026-10-23T03:01:01.167Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Keycloak / Red Hat Build of Keycloak (keycloak-services)
- Started: 2026-10-21
- CVEs: CVE-2026-18963
- Affected: org.keycloak:keycloak-services >= 26.0.0, < 26.4.15; >= 26.5.0, < 26.6.6; >= 26.7.0, < 26.7.2
- Fixed in: 26.4.15; 26.6.6; 26.7.2; 26.8.0 and later

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover/feed.xml
- JSON Feed: https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover.json
- This file: https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover/llms.txt

## Updates (newest first)
- 2026-10-21: Exploit-DB publishes EDB-52699 "Keycloak 26.7.2 - Unauthenticated Account Takeover" by Abel Maldonado (Orevim): a PoC with a safe --check mode and a --set-password takeover mode, tested on Keycloak 26.6.2. (https://www.exploit-db.com/exploits/52699)
- 2026-08-18: CVE-2026-18963 published with GitHub advisory GHSA-4gv3-mc9p-5wqc (critical); fixed in keycloak-services 26.4.15, 26.6.6 and 26.7.2, with Red Hat errata for Red Hat Build of Keycloak. (https://github.com/advisories/GHSA-4gv3-mc9p-5wqc)

## Fix brief
# Security brief: Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)

Source: https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover · status: live · severity: critical · updated Oct 23, 2026, 03:00 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.

Severity detail: CVSS 9.1 (Red Hat); unauthenticated takeover of any account; public PoC on Exploit-DB since Oct 21 2026; no confirmed in-the-wild exploitation reported

- Product: Keycloak / Red Hat Build of Keycloak (keycloak-services)
- CVE / advisory ids: CVE-2026-18963

## Affected versions
- org.keycloak:keycloak-services >= 26.0.0, < 26.4.15
- >= 26.5.0, < 26.6.6
- >= 26.7.0, < 26.7.2

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 26.4.15
- 26.6.6
- 26.7.2
- 26.8.0 and later

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 21, 2026: Exploit-DB publishes EDB-52699 "Keycloak 26.7.2 - Unauthenticated Account Takeover" by Abel Maldonado (Orevim): a PoC with a safe --check mode and a --set-password takeover mode, tested on Keycloak 26.6.2.
- Aug 18, 2026: CVE-2026-18963 published with GitHub advisory GHSA-4gv3-mc9p-5wqc (critical); fixed in keycloak-services 26.4.15, 26.6.6 and 26.7.2, with Red Hat errata for Red Hat Build of Keycloak.

## Advisories
- [Keycloak: unauthenticated account takeover via reset-credentials flow bypass (GHSA-4gv3-mc9p-5wqc)](https://github.com/advisories/GHSA-4gv3-mc9p-5wqc) (GitHub Advisory Database)
- [CVE-2026-18963](https://nvd.nist.gov/vuln/detail/CVE-2026-18963) (NVD)
- [CVE-2026-18963](https://access.redhat.com/security/cve/CVE-2026-18963) (Red Hat)
- [Keycloak 26.7.2 - Unauthenticated Account Takeover (EDB-52699)](https://www.exploit-db.com/exploits/52699) (Exploit-DB)

## Caveats
Exploit-DB title names 26.7.2 but the PoC header and GHSA list 26.7.2 as the fixed release; affected ranges above are from the advisory.

---
Machine-readable: https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.