Keycloak Password Reset Flaw Lets Unauthenticated Attackers Take Over Accounts

A newly disclosed security issue in the open‑source identity management server Keycloak could allow an attacker who has never logged into a system to reset passwords for any user and assume control of that account. Red Hat and the Keycloak team announced a patch today for the vulnerability identified by CVE‑2026‑18963, which is rated 9.1 on the Common Vulnerability Scoring System (CVSS) ¹. The flaw stems from improper session handling during the password‑reset process; when a token issued after authentication bypasses authorization checks against user attributes such as email verification status, an unauthenticated actor can craft a malicious URL that triggers a reset without needing prior credentials. The problem exists across deployments where tokens are short‑lived but still usable if not monitored, especially in environments lacking multi‑factor authentication or other strong access controls.

Keycloak’s design relies on centralized access control mechanisms that have architectural weaknesses around token validation. In many configurations, legacy systems may lack MFA while modern cloud-native setups expect tighter token lifetimes. This mismatch creates a window where attackers can exploit the reset flow before detection tools flag anomalous activity. The rapid release of patches demonstrates Red Hat’s awareness of how quickly such flaws can spread through organizations that rely on open‑source components. Failure to apply these fixes promptly could expose millions of users worldwide, given Keycloak’s widespread use in enterprise IAM solutions.

Security specialists note that this issue mirrors classic cases like Apache Struts’ remote code execution vulnerability (CVE‑2017‑5638) and Log4j’s global impact in 2021. Both incidents highlighted how unpatched dependencies can cascade into critical breaches. The current Keycloak flaw underscores why automated dependency scanning must be integrated directly into build pipelines; manual review simply cannot keep pace with today’s AI-driven development cycles. Organizations should also enforce zero‑trust principles at every layer: verify identity continuously, limit token scopes, and monitor for unusual password-reset requests via SIEM tooling. Even when tokens are short-lived, continuous monitoring reduces exploitation windows dramatically.

For end users, the immediate risk is that an attacker who never logged in can still take over an account if they know or guess a user’s email address. In practice, this means phishing campaigns targeting specific accounts may now succeed even without credential theft. Users should enable MFA wherever possible and consider disabling automatic password resets where feasible until the patch is applied. System administrators should audit existing reset flows to confirm that authorization checks occur after authentication and before any state changes.

Red Hat has released patches for both the Red Hat Enterprise Linux distribution and the upstream Keycloak project. Administrators are urged to update to the latest release as soon as practicable. Failure to do so could leave systems vulnerable to takeover attacks that bypass traditional login mechanisms entirely.

In summary, the CVE‑2026‑18963 vulnerability represents a significant threat to online privacy and security because it removes the barrier of prior authentication from the password‑reset process. The rapid response by Red Hat and the Keycloak community mitigates the danger but underscores how critical it is for organizations using open‑source IAM tools to stay current with patches and adopt robust identity verification practices.