Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Published: 2026-08-18
Score: 9.1 Critical
EPSS: 3.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the reset-credentials flow of the Keycloak‑services component allows an attacker who is not authenticated to force a password reset for any user. By bypassing the required email verification link, the attacker can directly set new credentials for the target account and thereby gain full control over that account, compromising confidentiality, integrity, and availability of the affected identity services.

Affected Systems

This vulnerability impacts Red Hat Build of Keycloak versions 26.4, 264.15, 26.6, 26.6.6, as well as the Red Hat JBoss Enterprise Application Platform Expansion Pack and Red Hat Single Sign‑On 7, all of which rely on the keycloak-services component for resetting credentials.

Risk and Exploitability

The CVSS score of 9.1 classifies this flaw as critical, and an EPSS score of 3 % indicates a moderate likelihood of exploitation in the wild. It is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves unauthenticated HTTP requests to the reset‑credentials endpoint from any system that can reach the Keycloak Services deployment; this can be performed without user interaction. If exploited, an attacker can hijack user accounts and potentially move laterally within the environment.

Generated by OpenCVE AI on August 25, 2026 at 19:01 UTC.

Remediation

Vendor Workaround

If an immediate upgrade is not possible, disabling the "Forgot password" functionality across all realms can be used as a temporary mitigation. In the RHBK administration console, navigate to: Realm settings → Login → Forgot password → Off Apply this setting to all realms. Upgrade to a fixed version as soon as possible.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a fixed release of Keycloak, JBoss EAP, or Single Sign‑On that addresses the reset‑credentials flow flaw.
  • Disable the "Forgot password" functionality in all realms as a temporary mitigation until a patch is applied; in the RHBK administration console navigate to Realm settings → Login → Forgot password → Off and apply this setting to all realms.
  • Configure additional safeguards such as enforcing email verification or implementing custom policies that validate the reset token before allowing credential changes, and strengthen account protection with multi‑factor authentication and strong password policies.

Generated by OpenCVE AI on August 25, 2026 at 19:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4gv3-mc9p-5wqc Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
History

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat build Of Keycloak
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat single Sign On
Vendors & Products Redhat build Of Keycloak
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat single Sign On

Thu, 20 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak:26.4
References

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Critical

Tue, 18 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak:26.4::el9
cpe:/a:redhat:build_keycloak:26.6::el9
References

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak: cpe:/a:redhat:build_keycloak:26.6
References

Tue, 18 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Title Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
First Time appeared Redhat
Redhat build Keycloak
Redhat jbosseapxp
Redhat red Hat Single Sign On
Weaknesses CWE-640
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat jbosseapxp
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Redhat Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform Expansion Pack Jbosseapxp Red Hat Single Sign On Single Sign On
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-20T22:25:58.686Z

Reserved: 2026-08-05T15:00:40.360Z

Link: CVE-2026-18963

cve-icon Vulnrichment

Updated: 2026-08-20T13:53:42.089Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-18T17:16:57.083

Modified: 2026-08-20T14:17:10.413

Link: CVE-2026-18963

cve-icon Redhat

Severity : Critical

Publid Date: 2026-08-17T00:00:00Z

Links: CVE-2026-18963 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T19:15:05Z

Weaknesses
  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password