CVE-2026-18963: Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the Keycloak reset-credentials authentication flow. The vulnerability exists in the way the flow state is managed, allowing an unauthenticated remote attacker to bypass the email verification requirement. By sending a specially crafted request to the reset-credentials endpoint, an attacker can transition the authentication session directly to the password update phase without possessing the required action token typically sent via email. Successful exploitation allows an attacker to perform a complete account takeover of any user, including administrative accounts, by resetting their password.
Other sources
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which accounts are exposed to takeover?
Any user account whose password can be reset through the affected reset-credentials flow may be targeted. The impact is full control of the target account after the attacker sets new credentials.
What does an attacker need to exploit the issue?
No authentication, user interaction, or email-verification-link click is required by the attacker. The attacker can force the reset process and set credentials directly.