CVE-2026-18963-Exploit

CVE-2026-18963 — Bypass de reset-credentials en Keycloak → toma de control de cuenta no autenticada Conociendo solo un nombre de usuario o dirección de correo electrónico , un atacante no autenticado establece una contraseña arbitraria en cualquier cuenta de Keycloak. El correo de restablecimient...

CVE-2026-18963

CVE-2026-18963 通过重置凭据流程绕过实现未认证账户接管...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

CVE-2026-18963-keycloak

CVE-2026-18963-keycloak CVE-2026-18963 — Keycloak reset-credentials 绕过 - 账户接管...

KeySniper

KeySniper 作者： Mitsec — x.com/ynsmroztas CVE-2026-18963 — 通过重置凭据流程实现未认证的 Keycloak 账户接管。 KeySniper 是一款面向生产环境的扫描器，适用于范围内的漏洞赏金和授权评估：实时雷达输出、领域（realm）发现、检测与接管区分、交互式 ATO 后 Shell，以及标准输入管道（subfinder → httpx → KeySniper）。 默认模式为检测 （--takeover 0）。--takeover 1 会修改目标上的账户密码。 漏洞 字段| 值 ---|--- CVE| CVE-2026-18963...

CVE-2026-18963

Keycloak 重置路径查找器 用于发现暴露的 Keycloak reset-credentials 端点的 Nuclei 模板，覆盖多个代理前缀、上下文路径、领域名称和路径变体。 摘要 该模板有助于识别可访问的密码重置流程，这些流程在验证受以下影响的环境时可能具有相关性： CVE-2026-18963 通过 reset-credentials 流程绕过实现 Keycloak 未认证账户接管 根据公开的 Keycloak 问题，该漏洞允许未认证攻击者强制对用户执行密码重置流程，而无需预期的电子邮件验证链接，从而可能导致完全账户接管。 参考：...

keycloak-CVE-2026-18963

CVE-2026-18963 - Keycloak reset-credentials 流程绕过 用于测试受 reset-credentials 流程绕过影响的 Keycloak 26.x 版本的 Docker 环境。随附的实验室将 Keycloak 固定为 26.6.2 ，该版本位于受影响范围内（26.0 且 --username \ --new-password '' \ --allow-loopback-http-cookie --change-password loopback-cookie 选项仅适用于此 HTTP Docker 实验室。 成功验证/利用...

BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Exploit for CVE-2026-18963

CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...

Keycloak 26.4.x < 26.4.15 / 26.6.x < 26.6.6 Unauthenticated Account Takeover

The version of Keycloak installed on the remote host is 26.4.x prior to 26.4.15, or 26.6.x prior to 26.6.6. It is, therefore, affected by a vulnerability: - A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

Critical: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update

New Red Hat build of Keycloak 26.4.15 packages are available from the Customer Portal Red Hat build of Keycloak 26.4.15 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963

A critical flaw in the reset-credentials flow of Keycloak 26.0.0–26.7.1 allows an unauthenticated attacker to force a password reset for any user—including administrators—without clicking the required email verification link, enabling full account takeover . The root cause involves two chained de...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2025-71317

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax...