Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

CVE-2026-18963-Exploit

CVE-2026-18963 — Keycloak reset-credentials 우회 → 인증되지 않은 계정 탈취 오직 사용자 이름 또는 이메일 주소 만 알면, 인증되지 않은 공격자는 임의의 Keycloak 계정에 임의의 비밀번호를 설정할 수 있습니다. 비밀번호 재설정 이메일은 실제 피해자에게 전달되며 절대 필요하지 않습니다 — 공격자는 사서함을 읽지도, 링크를 클릭하지도 않으며, 사전 자격 증명이나 세션을 보유하지 않습니다. 영향받는 버전: Keycloak 26.0.0 – 26.7.1. 26.7.2에서 수정됨. 취약한가요? 명...

CVE-2026-18963

CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass...

KeySniper

KeySniper 저자: Mitsec — x.com/ynsmroztas CVE-2026-18963 — reset-credentials 흐름을 통한 인증되지 않은 Keycloak 계정 탈취. KeySniper는 버그 바운티 범위 내 및 승인된 평가를 위한 운영 지향 스캐너입니다: 실시간 레이더 출력, realm 탐지, 탐지 vs 탈취, 대화형 ATO 후 셸, stdin 파이프라인subfinder → httpx → KeySniper을 제공합니다. 기본 모드는 detect--takeover 0입니다. --takeover 1은 대상...

CVE-2026-18963-keycloak

CVE-2026-18963-keycloak CVE-2026-18963 — Keycloak reset-credentials 우회 - 계정 탈취...

CVE-2026-18963

Keycloak Reset Path Finder Nuclei-шаблон для обнаружения открытых конечных точек reset-credentials Keycloak среди множества прокси-префиксов, путей контекста, имен доменов realm и вариаций путей. Краткое описание Этот шаблон помогает выявить доступные потоки сброса пароля, которые могут быть...

keycloak-CVE-2026-18963

CVE-2026-18963 - Обход процесса сброса учётных данных Keycloak Docker-настройка для тестирования версий Keycloak 26.x, затронутых обходом процесса сброса учётных данных. Включённая лаборатория фиксирует Keycloak 26.6.2 , который находится в затронутом диапазоне 26.0 и --username \ --new-password ...

Authentication Bypass

Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...

BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Exploit for CVE-2026-18963

CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...

Keycloak 26.4.x < 26.4.15 / 26.6.x < 26.6.6 Unauthenticated Account Takeover

The version of Keycloak installed on the remote host is 26.4.x prior to 26.4.15, or 26.6.x prior to 26.6.6. It is, therefore, affected by a vulnerability: - A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update

New Red Hat build of Keycloak 26.4.15 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.15 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963

A critical flaw in the reset-credentials flow of Keycloak 26.0.0–26.7.1 allows an unauthenticated attacker to force a password reset for any user—including administrators—without clicking the required email verification link, enabling full account takeover . The root cause involves two chained de...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...