CVE-2026-18963

CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

KeySniper

KeySniper 作者： Mitsec — x.com/ynsmroztas CVE-2026-18963 — 通过重置凭据流程实现未认证的 Keycloak 账户接管。 KeySniper 是一款面向生产环境的扫描器，适用于范围内的漏洞赏金和授权评估：实时雷达输出、领域（realm）发现、检测与接管区分、交互式 ATO 后 Shell，以及标准输入管道（subfinder → httpx → KeySniper）。 默认模式为检测 （--takeover 0）。--takeover 1 会修改目标上的账户密码。 漏洞 字段| 值 ---|--- CVE| CVE-2026-18963...

CVE-2026-18963-keycloak

CVE-2026-18963-keycloak CVE-2026-18963 — Keycloak reset-credentials 绕过 - 账户接管...

CVE-2026-18963

Keycloak 重置路径查找器 用于发现暴露的 Keycloak reset-credentials 端点的 Nuclei 模板，覆盖多个代理前缀、上下文路径、领域名称和路径变体。 摘要 该模板有助于识别可访问的密码重置流程，这些流程在验证受以下影响的环境时可能具有相关性： CVE-2026-18963 通过 reset-credentials 流程绕过实现 Keycloak 未认证账户接管 根据公开的 Keycloak 问题，该漏洞允许未认证攻击者强制对用户执行密码重置流程，而无需预期的电子邮件验证链接，从而可能导致完全账户接管。 参考：...

keycloak-CVE-2026-18963

CVE-2026-18963 - Keycloak reset-credentials 流程绕过 用于测试受 reset-credentials 流程绕过影响的 Keycloak 26.x 版本的 Docker 环境。随附的实验室将 Keycloak 固定为 26.6.2 ，该版本位于受影响范围内（26.0 且 --username \ --new-password '' \ --allow-loopback-http-cookie --change-password loopback-cookie 选项仅适用于此 HTTP Docker 实验室。 成功验证/利用...

CVE-2026-18963-Exploit

CVE-2026-18963 — Keycloak reset-credentials 绕过 → 未认证账户接管 仅凭用户名或电子邮件地址 ，未认证的攻击者即可在任何 Keycloak 账户上设置一个 任意密码。密码重置电子邮件会发送 给真正的受害者，但攻击者完全不需要它 — 攻击者从不读取邮箱，从不 点击链接，也不持有任何先前的凭据或会话。 受影响：Keycloak 26.0.0 – 26.7.1。已在 26.7.2 中修复。 我是否易受攻击？ 一条命令。无需有效用户名，且无副作用 — 它不会发送 电子邮件，不会写入任何账户，并会在可利用步骤之前停止。bash git clone...

Authentication Bypass

Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...

BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Exploit for CVE-2026-18963

CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...

Keycloak 26.4.x < 26.4.15 / 26.6.x < 26.6.6 Unauthenticated Account Takeover

The version of Keycloak installed on the remote host is 26.4.x prior to 26.4.15, or 26.6.x prior to 26.6.6. It is, therefore, affected by a vulnerability: - A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update

New Red Hat build of Keycloak 26.4.15 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.15 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

CVE-2026-18963

A critical flaw in the reset-credentials flow of Keycloak 26.0.0–26.7.1 allows an unauthenticated attacker to force a password reset for any user—including administrators—without clicking the required email verification link, enabling full account takeover . The root cause involves two chained de...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...