Red Hat has disclosed a critical vulnerability in the Red Hat Build of Keycloak that could allow unauthenticated remote attackers to take over arbitrary user accounts. Tracked as CVE-2026-18963, the flaw affects the password recovery process and carries a CVSS v3.1 score of 9.1.

The vulnerability exists in the reset-credentials flow of the keycloak-services component, the core identity and access management engine used by Red Hat Build of Keycloak.

According to Red Hat, an attacker can trigger a password reset for any target account and bypass the email verification action that should authorize the recovery request.

This means an attacker does not need valid credentials, prior access to a Keycloak realm, or interaction from the targeted user. By abusing the flawed recovery flow, the attacker can set new credentials for a selected account and gain full control of it.

Red Hat Keycloak Flaw

The issue was publicly disclosed on August 17, 2026, and Red Hat last updated its advisory on August 20. Red Hat rated the flaw Critical because it can be exploited remotely over the network with low attack complexity, no privileges required, and no user interaction.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The flaw has a high impact on confidentiality and integrity. A successful attacker could access information available to the compromised user and perform actions using that user’s permissions.

In environments where Keycloak manages administrator, developer, customer, or service accounts, compromise of a high-privilege identity could lead to wider access across connected applications and services.

Red Hat linked CVE-2026-18963 to CWE-640, a weakness involving password recovery mechanisms. The root cause is improper state validation in the reset-credentials authentication flow.

In a secure recovery process, Keycloak should verify that the user has completed the required email-based action before allowing the user’s credentials to be changed. The vulnerable flow does not adequately enforce that condition.

Red Hat has released fixes through several security errata issued on August 18. Fixed packages include Red Hat builds of Keycloak 26.4 and 26.6 release streams, as well as updated keycloak-services packages in versions 26.4.15 and 26.6.6.

Relevant fixes are available through RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524. Organizations should identify all deployments of Red Hat Build of Keycloak, including standalone instances, operator-managed installations, and OpenShift deployments.

Administrators should apply the appropriate Red Hat errata and move to a fixed version as soon as possible. When immediate patching is not possible, Red Hat recommends turning off the “Forgot password” feature across all realms.

Administrators can do this in the Keycloak administration console by navigating to Realm settings, selecting Login, and setting Forgot password to Off.

Security teams should also review password-reset logs, account credential changes, unusual administrative logins, and authentication events involving privileged accounts. Any unexpected reset activity should be investigated as a potential account takeover attempt.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Critical Red Hat Keycloak Flaw Lets Unauthenticated Attackers Take Over Any User Account appeared first on Cyber Security News.