Main
Vulnerability Database
Exploits
ID:13058 - Exploit for Weak Password Recovery Mechanism for Forgotten Password in Keycloak - CVE-2026-18963
ID:13058 - Exploit for Weak Password Recovery Mechanism for Forgotten Password in Keycloak - CVE-2026-18963
Published: September 4, 2026
Vulnerability identifier: #VU146635
Vulnerability risk: High
CVE-ID: CVE-2026-18963
CWE-ID: CWE-640
Exploitation vector: Remote access
Vulnerable software:
Keycloak
Red Hat build of Keycloak
Keycloak
Red Hat build of Keycloak
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to take over arbitrary user accounts.
The vulnerability exists due to a weak password recovery mechanism in the reset-credentials flow of the keycloak-services component when handling password reset requests. A remote attacker can bypass the required email verification link and set new credentials to take over arbitrary user accounts.
Remediation
Install security update from vendor's website.