Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

CVE-2026-18963

Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...

keycloak-CVE-2026-18963

CVE-2026-18963 - Keycloak reset-credentials flow bypass Docker setup for testing Keycloak 26.x versions affected by the reset-credentials flow bypass. The included lab pins Keycloak 26.6.2 , which is in the affected range 26.0 and --username \ --new-password '' \ --allow-loopback-http-cookie...

CVE-2026-18963-Exploit

CVE-2026-18963 — Keycloak reset-credentials bypass → unauthenticated account takeover Knowing only a username or e-mail address , an unauthenticated attacker sets an arbitrary password on any Keycloak account. The password-reset e-mail is delivered to the real victim and is never needed — the...

CVE-2026-18963

CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass...

CVE-2026-18963-keycloak

CVE-2026-18963-keycloak CVE-2026-18963 — Keycloak reset-credentials bypass - Account Takeover...

KeySniper

KeySniper Author: Mitsec — x.com/ynsmroztas CVE-2026-18963 — unauthenticated Keycloak account takeover via the reset-credentials flow. KeySniper is a production-oriented scanner for in-scope bug bounty and authorized assessments: live radar output, realm discovery, detect vs takeover, interactive...

Authentication Bypass

Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...

BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Exploit for CVE-2026-18963

CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...

Keycloak 26.4.x < 26.4.15 / 26.6.x < 26.6.6 Unauthenticated Account Takeover

The version of Keycloak installed on the remote host is 26.4.x prior to 26.4.15, or 26.6.x prior to 26.6.6. It is, therefore, affected by a vulnerability: - A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update

New Red Hat build of Keycloak 26.4.15 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.15 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

CVE-2026-18963

A critical flaw in the reset-credentials flow of Keycloak 26.0.0–26.7.1 allows an unauthenticated attacker to force a password reset for any user—including administrators—without clicking the required email verification link, enabling full account takeover . The root cause involves two chained de...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...