RHSA-2026:56520: Critical: Red Hat build of Keycloak 26.4.15 Security Update
Critical: Red Hat build of Keycloak 26.4.15 Security Update
Other sources
Red Hat build of Keycloak 26.4.15 is a standalone server, based onthe Keycloak project, that provides authentication andstandards-based single sign-on capabilities for web and mobileapplications.Security fixes: Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat build of Keycloak 26.4.15to a version that resolves this vulnerability.Fixed in 26.4.15Patch CVE-2026-18963 - Operational
Back up your existing Keycloak 26.4.15 installation before applying the update, including all applications, configuration files, databases, and database settings.
Event History
Frequently Asked Questions
Which environments should be prioritized for triage?
Any deployment using the affected Red Hat build of Keycloak is relevant because the issue is an unauthenticated account-takeover flaw in the reset-credentials flow. Applications relying on the server for authentication or single sign-on may be impacted through compromised user accounts.
Does exploitation require an existing authenticated account?
An attacker does not need to authenticate to exploit the described issue. The affected component is the reset-credentials flow, so exposure depends on use of that flow.
What should teams do if their deployment is affected?
The available advisory information identifies this as a security update for Red Hat build of Keycloak 26.4.15 and does not provide a workaround or mitigation. Apply the supplied security update where possible.