Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Priority MEDIUM 55CWE-640Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 4 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-640.
Summary
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04682 91st percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-services (Maven): 26.4.15, 26.6.6, 26.7.2Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | — | 26.4.15-1 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.4 | — | 26.4-23 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.4 | — | 26.4-23 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.4.15 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Keycloak 26.4.15 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Keycloak 26.6 | — | 26.6.6-1 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.6 | — | 26.6-12 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.6 | — | 26.6-12 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.6.6 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Keycloak 26.6.6 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Keycloak 26.6.6 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
| — | org.keycloak:keycloak-services (Maven) | 26.0.0 to before 26.4.15 | 26.4.15 | Patch available | GHSA-4gv3-mc9p-5wqc |
| — | org.keycloak:keycloak-services (Maven) | 26.5.0 to before 26.6.6 | 26.6.6 | Patch available | GHSA-4gv3-mc9p-5wqc |
| — | org.keycloak:keycloak-services (Maven) | 26.7.0 to before 26.7.2 | 26.7.2 | Patch available | GHSA-4gv3-mc9p-5wqc |
- Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.15-1 Patch available CNA
- Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-23 Patch available CNA
- Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-23 Patch available CNA
- Red Hat build of Keycloak 26.4.15 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Keycloak 26.4.15 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6.6-1 Patch available CNA
- Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-12 Patch available CNA
- Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-12 Patch available CNA
- Red Hat build of Keycloak 26.6.6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Keycloak 26.6.6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Keycloak 26.6.6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- org.keycloak:keycloak-services (Maven) Vendor— Affected 26.0.0 to before 26.4.15 Fixed in 26.4.15 Patch available GHSA-4gv3-mc9p-5wqc
- org.keycloak:keycloak-services (Maven) Vendor— Affected 26.5.0 to before 26.6.6 Fixed in 26.6.6 Patch available GHSA-4gv3-mc9p-5wqc
- org.keycloak:keycloak-services (Maven) Vendor— Affected 26.7.0 to before 26.7.2 Fixed in 26.7.2 Patch available GHSA-4gv3-mc9p-5wqc
CPE names CNA · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:build_keycloak:26.4::el9 | 26.4 | — | Red Hat |
| cpe:/a:redhat:build_keycloak:26.4 | 26.4 | — | Red Hat |
| cpe:/a:redhat:build_keycloak:26.6::el9 | 26.6 | — | Red Hat |
| cpe:/a:redhat:build_keycloak:26.6 | 26.6 | — | Red Hat |
| cpe:/a:redhat:jbosseapxp | — | — | Red Hat |
| cpe:/a:redhat:red_hat_single_sign_on:7 | 7 | — | Red Hat |
- cpe:/a:redhat:build_keycloak:26.4::el9 Versions 26.4 — ·Red Hat
- cpe:/a:redhat:build_keycloak:26.4 Versions 26.4 — ·Red Hat
- cpe:/a:redhat:build_keycloak:26.6::el9 Versions 26.6 — ·Red Hat
- cpe:/a:redhat:build_keycloak:26.6 Versions 26.6 — ·Red Hat
- cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
- cpe:/a:redhat:red_hat_single_sign_on:7 Versions 7 — ·Red Hat
Remediation
- Fix · GHSA-4gv3-mc9p-5wqc org.keycloak:keycloak-services (Maven) Fixed in 26.4.15 Advisory →
- Fix · GHSA-4gv3-mc9p-5wqc org.keycloak:keycloak-services (Maven) Fixed in 26.6.6 Advisory →
- Fix · GHSA-4gv3-mc9p-5wqc org.keycloak:keycloak-services (Maven) Fixed in 26.7.2 Advisory →
Red Hat 4 advisories
- RHSA-2026:56519 Released 2026-08-18 · Red Hat rating CriticalRed Hat build of Keycloak 26.4.15 Images Security Update
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2026:56524 Released 2026-08-18 · Red Hat rating CriticalRed Hat build of Keycloak 26.6.6 Images Security Update
- Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2026:56523 Released 2026-08-18 · Red Hat rating CriticalRed Hat build of Keycloak 26.6.6 Security Update
- Red Hat build of Keycloak 26.6.6
Show 1 more Red Hat advisories
- RHSA-2026:56520 Released 2026-08-18 · Red Hat rating CriticalRed Hat build of Keycloak 26.4.15 Security Update
- Red Hat build of Keycloak 26.4.15
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat build of Keycloak 26.4 | Fixed | RHSA-2026:56519 |
| Red Hat build of Keycloak 26.4.15 | Fixed | RHSA-2026:56520 |
| Red Hat build of Keycloak 26.6 | Fixed | RHSA-2026:56524 |
| Red Hat build of Keycloak 26.6.6 | Fixed | RHSA-2026:56523 |
Not affected: 1 product
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18963
- 2026-10-03 Alias added: GHSA-4gv3-mc9p-5wqc
- 2026-10-23 EPSS moved to the 90th–95th percentile
- 2026-10-23 Affected versions changed · CNA
- 2026-10-24 Affected versions changed · Red Hat
References
Advisory 5
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-18963 · CVE Program
- CVE-2026-18963 · NVD
- FIRST EPSS
- GHSA-4gv3-mc9p-5wqc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-18963 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences