Weak Password Recovery Mechanism for Forgotten Password in Keycloak - CVE-2026-18963
Published: September 1, 2026 / Updated: September 10, 2026
Vulnerability identifier: #VU146635
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18963
CWE-ID: CWE-640
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to take over arbitrary user accounts.
The vulnerability exists due to a weak password recovery mechanism in the reset-credentials flow of the keycloak-services component when handling password reset requests. A remote attacker can bypass the required email verification link and set new credentials to take over arbitrary user accounts.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2026-18963
Install security update from vendor's website.
Keycloak - addressed in versions 26.4.15, 26.6.6, 26.7.2
Red Hat build of Keycloak - addressed in versions 26.4.15, 26.6.6
Red Hat build of Keycloak - addressed in versions 26.4.15, 26.6.6
Links to Public Exploits and PoC-codes
- Exploit #13058 - CVE-2026-18963 (September 4, 2026)
- Exploit #13048 - 0day-Exploits (Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).) (September 4, 2026)