Reset-credentials flow bypass allows unauthenticated account takeover in Red Hat Build of Keycloak (CVE-2026-18963)
Public exploit code is circulating and VulnCheck added this to its known-exploited catalog on 2026-08-18, so unpatched Keycloak deployments with exposed reset-credentials flows can have arbitrary user accounts hijacked right now.
A flaw in the keycloak-services reset-credentials flow lets an unauthenticated attacker complete a password reset for any user without the email verification link ever being clicked, letting them set new credentials and take full control of target accounts.
Affected: Red Hat build of Keycloak prior to 26.4.15
How to Test
Confirm your Keycloak server version is below 26.4.15; review authentication event logs for password-reset (reset-credentials) completions that were not preceded by a corresponding email verification link click, and audit recent credential changes on privileged accounts.
How to Patch
Back up your installation (applications, configuration files, databases and settings) and update to Red Hat build of Keycloak 26.4.15 per RHSA-2026:56519 (OpenShift images/operator) or RHSA-2026:56520 (standalone packages).