What The Flaw Breaks
The Hacker News says CVE-2026-18963 is a critical Keycloak flaw in the reset-credentials flow that can let an unauthenticated attacker take over any account by bypassing the emailed action token during password reset.
That is the important line to hold onto. This is not a bug in a fringe feature. It is a defect in the recovery path many teams rely on as a safety valve for legitimate users and administrators.
Why The Identity Angle Matters More Than The CVSS
A compromised password-reset flow is strategically ugly because it lets the attacker move around the usual front door. They do not need to phish a user successfully if they can bend the product's own recovery mechanism into a takeover path.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. 5 minutes or less.
Built from 100+ trusted cybersecurity sources.
Keycloak also sits in front of other applications, which means the effect is rarely isolated to the identity server itself. One account takeover can become access to multiple downstream services that trust the same realm.
Fixed Versions And Temporary Mitigation
The issue is fixed upstream in Keycloak 26.7.2, with Red Hat shipping fixes in its supported builds as well. The source reporting also notes a useful temporary mitigation for teams that cannot patch immediately: disable the "Forgot password" capability per realm until the update lands.
The lack of confirmed in-the-wild exploitation should not create false comfort. Recovery-path bugs are exactly the kind of issue that can move from interesting to urgent once a clean exploitation recipe circulates.
What Teams Should Do Next
Treat this as an identity-recovery hardening issue, not just a product update.
- Patch every Keycloak deployment to 26.7.2 or the corresponding fixed Red Hat build as quickly as possible.
- If patching cannot happen immediately, disable the "Forgot password" flow on affected realms as a temporary containment step.
- Review password-reset activity, privileged account changes, and suspicious login events for signs the recovery path was abused.
- Map which business-critical apps rely on the affected Keycloak realms so leadership understands the downstream blast radius of a single account takeover.
- Use this story to review whether identity recovery paths get the same scrutiny as login and MFA flows in your security design.
Source Context
CyberExperts used The Hacker News as the primary source and preserved the operational details that make the story actionable: CVE-2026-18963, the reset-token bypass, the fixed Keycloak and Red Hat builds, the temporary realm-level mitigation, and the takeover impact on any account behind the affected flow.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
