Keycloak Critical Flaw: Force Password Reset and Account Takeover Risk

Critical Vulnerability in Keycloak: What You Need to KnowKeycloak, a widely adopted identity and access management (IAM) solution in corporate environ...

Critical Vulnerability in Keycloak: What You Need to Know

Keycloak, a widely adopted identity and access management (IAM) solution in corporate environments, has addressed a critical security flaw that could allow attackers to take over any account without prior authentication. The vulnerability, tracked as CVE-2026-18963, carries a CVSS score of 9.1 out of 10, indicating severe risk. This flaw affects the password reset flow, enabling a remote attacker to change a user's password without completing the usual email verification step.

How the Exploit Works

The root cause lies in improper state validation during the credential reset process. Under normal circumstances, a user must click a link sent to their email to confirm a password change. However, due to this flaw, the system can accept a sequence of steps that should be blocked until that confirmation occurs. This results in a bypass: the attacker skips the verification phase and directly reaches the password change endpoint, allowing them to set a new password and subsequently log in as the legitimate user.

The most concerning scenario involves targeting administrative accounts. With such access, an attacker could modify policies, create new users, assign roles, or alter configurations affecting all applications integrated with Keycloak. The CVSS metrics reflect the danger: the attack can be executed remotely, requires low complexity, needs no privileges, and involves no user interaction. The impact is primarily on confidentiality and integrity, with availability not directly affected.

Patches and Mitigations

The upstream project has released a fix in Keycloak version 26.7.2, dated 19 August 2026. For users of the Red Hat Build of Keycloak (RHBK), updates are available in branches 26.4 and 26.6, specifically versions 26.4.15 and 26.6.6. As of 24 August 2026, there is no evidence of active exploitation, and no verified public exploit has been identified. Nevertheless, immediate action is strongly recommended.

If you cannot update right away, the most straightforward mitigation is to disable the “Forgot password” feature across all realms. This is not a one-time task: the option is configured per realm, so you must verify that no realm has it enabled, especially in environments with multiple realms for subsidiaries, clients, or internal applications.

Post-Patch Audit: A Crucial Step

After applying the patch or mitigation, auditing is equally important. Reviewing login events and credential changes, particularly for privileged accounts, can help detect any anomalous resets and assess the potential impact if someone attempted to exploit the vulnerability during the exposure window. In IAM systems, a flaw like this does not affect a single application; it can compromise the entire ecosystem of connected services.

Broader Implications for Server Security

This incident underscores the importance of robust server security practices. For system administrators and hosting providers, it serves as a reminder that identity management is a critical component of your infrastructure. A single vulnerability in an IAM tool can undermine all your other security measures. Therefore, staying vigilant with updates and monitoring is essential.

At ALMC.es, we understand the challenges of managing secure and reliable server environments. Our Abuse Shield service centralises server protection by automatically blocking malicious IPs, managing fail2ban across multiple machines, and sharing a reputation feed among all your servers. This proactive approach helps mitigate risks before they become breaches, complementing your IAM security.

While no security solution is foolproof, combining timely patching with layered defences significantly reduces your attack surface. If you need assistance securing your servers or implementing robust protection measures, our team in Lleida is ready to help businesses across Spain, including Barcelona, Tarragona, and Girona.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.