51 matches found
Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass
Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...
keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset...
keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset...
CVE-2026-103112 Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset...
CVE-2026-103112
A flaw in the keycloak-services component of Keycloak allows for account takeover via an authentication race condition. The vulnerability arises because the system fails to verify if an authenticator remains valid when transitioning between the standard authentication path and the reset credentia...
CVE-2026-18963-Exploit
CVE-2026-18963 — Keycloak reset-credentials bypass → unauthenticated account takeover Knowing only a username or e-mail address , an unauthenticated attacker sets an arbitrary password on any Keycloak account. The password-reset e-mail is delivered to the real victim and is never needed — the...
KeySniper
KeySniper Author: Mitsec — x.com/ynsmroztas CVE-2026-18963 — unauthenticated Keycloak account takeover via the reset-credentials flow. KeySniper is a production-oriented scanner for in-scope bug bounty and authorized assessments: live radar output, realm discovery, detect vs takeover, interactive...
CVE-2026-18963
Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...
CVE-2026-18963
CVE-2026-18963 Keycloak Unauthenticated Account Takeover ★ CVE-2026-18963 Keycloak Reset-Credentials Flow Bypass PoC ★ https://github.com/user-attachments/assets/ebed1e64-a40c-4333-be18-9acbadd655b0 Overview CVE-2026-18963 is a critical unauthenticated account takeover vulnerability in the Keyclo...
keycloak-CVE-2026-18963
CVE-2026-18963 - Keycloak reset-credentials flow bypass Docker setup for testing Keycloak 26.x versions affected by the reset-credentials flow bypass. The included lab pins Keycloak 26.6.2 , which is in the affected range 26.0 and --username \ --new-password '' \ --allow-loopback-http-cookie...
CVE-2026-18963-keycloak
CVE-2026-18963-keycloak CVE-2026-18963 — Keycloak reset-credentials bypass - Account Takeover...
Keycloak CVE-2026-18963 reset-credentials bypass
CVE-2026-18963 Keycloak 26.0.0–26.7.1: re-navigation to reset-credentials re-opens the authentication selector and reset-credential-email accepts success without the emailed action token. Default: detect-only; set confirm=true to overwrite the target user's password destructive ATO. !/usr/bin/env...
Keycloak 26.7.1 Unauthenticated Account Takeover
Keycloak versions 26.0.0 through 26.4.14, 26.5.0 through 26.6.5, and 26.7.0 through 26.7.1 contain a reset-credentials flow bypass that can allow an unauthenticated attacker to set a user password. Exploit Title: Keycloak 26.7.2 - Unauthenticated Account Takeover Date: 2026-10-15 Exploit Author:...
Exploit for CVE-2026-18963
CVE-2026-18963: Keycloak reset-credentials flow bypass Unauth...
Exploit for CVE-2026-18963
CVE-2026-18963-ke...
Exploit for CVE-2026-18963
My-Exploits Vulnerability research I have done on four widely...
Exploit for CVE-2026-18963
0day-Exploits Vulnerability research I have done on four wide...
Authentication Bypass
Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...