Exploit Database
@ExploitDB
[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover dlvr.it/TW0wH6
Public Exploit
Security incidents tagged Public Exploit. Newest first.
1 Public Exploit incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 1
- Longest quiet run: 63 days (Aug 19–Oct 20)
- Patched
Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)
A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.
Keycloak / Red Hat Build of Keycloak (keycloak-services)Since Oct 21, 2026
