47 matches found
CVE-2026-18963-Exploit
CVE-2026-18963 — Keycloak reset-credentials bypass → unauthenticated account takeover Knowing only a username or e-mail address , an unauthenticated attacker sets an arbitrary password on any Keycloak account. The password-reset e-mail is delivered to the real victim and is never needed — the...
CVE-2026-18963-keycloak
CVE-2026-18963-keycloak CVE-2026-18963 — Keycloak reset-credentials bypass - Account Takeover...
Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass
Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...
KeySniper
KeySniper Author: Mitsec — x.com/ynsmroztas CVE-2026-18963 — unauthenticated Keycloak account takeover via the reset-credentials flow. KeySniper is a production-oriented scanner for in-scope bug bounty and authorized assessments: live radar output, realm discovery, detect vs takeover, interactive...
CVE-2026-18963
CVE-2026-18963 Keycloak Unauthenticated Account Takeover ★ CVE-2026-18963 Keycloak Reset-Credentials Flow Bypass PoC ★ https://github.com/user-attachments/assets/ebed1e64-a40c-4333-be18-9acbadd655b0 Overview CVE-2026-18963 is a critical unauthenticated account takeover vulnerability in the Keyclo...
CVE-2026-18963
Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...
keycloak-CVE-2026-18963
CVE-2026-18963 - Keycloak reset-credentials flow bypass Docker setup for testing Keycloak 26.x versions affected by the reset-credentials flow bypass. The included lab pins Keycloak 26.6.2 , which is in the affected range 26.0 and --username \ --new-password '' \ --allow-loopback-http-cookie...
Keycloak CVE-2026-18963 reset-credentials bypass
CVE-2026-18963 Keycloak 26.0.0–26.7.1: re-navigation to reset-credentials re-opens the authentication selector and reset-credential-email accepts success without the emailed action token. Default: detect-only; set confirm=true to overwrite the target user's password destructive ATO. !/usr/bin/env...
Keycloak 26.7.1 Unauthenticated Account Takeover
Keycloak versions 26.0.0 through 26.4.14, 26.5.0 through 26.6.5, and 26.7.0 through 26.7.1 contain a reset-credentials flow bypass that can allow an unauthenticated attacker to set a user password. Exploit Title: Keycloak 26.7.2 - Unauthenticated Account Takeover Date: 2026-10-15 Exploit Author:...
Exploit for CVE-2026-18963
CVE-2026-18963: Keycloak reset-credentials flow bypass Unauth...
Exploit for CVE-2026-18963
CVE-2026-18963-ke...
Exploit for CVE-2026-18963
My-Exploits Vulnerability research I have done on four widely...
Exploit for CVE-2026-18963
0day-Exploits Vulnerability research I have done on four wide...
Authentication Bypass
Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...
Exploit for CVE-2026-18963
CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detecto...
Exploit for CVE-2026-18963
CVE-2026-18963 — Keycloak reset-credentials flow bypass Autho...
BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
Exploit for CVE-2026-18963
CVE-2026-18963 — Keycloak Unauthenticated Account Takeover...