Loading story…
Red Hat released security updates for Red Hat build of Keycloak to fix a critical account-takeover vulnerability, tracked as CVE-2026-18963, in the keycloak-services component. The flaw affects the reset-credentials flow and allows an unauthenticated remote attacker to bypass the email verification step during password recovery, reset a victim's password, and take full control of the account. Affected versions include 26.4.x before 26.4.15 and 26.6.x before 26.6.6, with scanners such as Nessus flagging vulnerable deployments based on reported version information.
Red Hat addressed the issue in advisories RHSA-2026:56523 and RHSA-2026:56524, releasing updated packages, container images, and an updated Operator for OpenShift. The advisories also bundle fixes for additional Keycloak security issues, including hidden group metadata disclosure, predictable account-linking hashes that could enable takeover through a malicious OIDC client, rotated client secret leakage via the Admin REST API, and a TOCTOU privilege-escalation bug. Red Hat advised customers to back up installations before upgrading, while Red Hat JBoss Enterprise Application Platform Expansion Pack was also listed as affected but did not yet have a vendor patch in the referenced reporting.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat published critical advisories RHSA-2026:56523 and RHSA-2026:56524 and released Red Hat build of Keycloak 26.6.6 packages and OpenShift images. The updates fixed CVE-2026-18963 along with several other vulnerabilities affecting authentication, authorization, and privilege boundaries.
The account takeover flaw CVE-2026-18963 in Keycloak's reset-credentials flow was published. The issue allows an unauthenticated attacker to bypass the email verification step and reset a target user's password.
Red Hat disclosed that Red Hat build of Keycloak 26.6.x before 26.6.6 and 26.4.x before 26.4.15 are affected by CVE-2026-18963, and recommended upgrading to 26.6.6 or 26.4.15. The notice also stated that Red Hat JBoss Enterprise Application Platform Expansion Pack was affected but did not yet have a vendor patch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcecsirt.sk
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat and the Keycloak project patched **CVE-2026-18963**, a critical flaw in the `keycloak-services` component that allows an unauthenticated remote attacker to take over arbitrary accounts, including administrators. The vulnerability affects the password recovery process: improper state validation in the reset-credentials flow lets a crafted request bypass the normal email verification or action-token step and proceed directly to changing a user's password. Red Hat assigned the issue a **CVSS 9.1** score and classified it as **CWE-640**. Affected versions include upstream Keycloak releases earlier than **26.7.2** and Red Hat Build of Keycloak versions earlier than **26.4.15** and **26.6.6**. Red Hat and CERT-PY urged organizations to apply the available security updates, while Red Hat also published a temporary mitigation for environments that cannot patch immediately by disabling the **"Forgot password"** feature across all realms. A Nuclei template pull request was also opened to detect the issue, underscoring rapid defender interest, although no verified public exploit or confirmed in-the-wild exploitation had been reported at publication time.
Aug 31, 2026
Keycloak disclosed and patched a high-severity privilege escalation flaw, **CVE-2026-9795**, in its Fine-Grained Admin Permissions v2 (`FGAPv2`) feature after researchers reported that a delegated administrator could bypass missing authorization checks in the admin REST API and add arbitrary realm roles to a client’s scope mapping. That weakness allowed limited administrators to inject elevated roles such as `realm-admin` into tokens later issued to users authenticating through the affected client, creating a path to downstream privilege escalation in deployments running Keycloak `26.2.0` and later with `FGAPv2` enabled. The issue was later listed as fixed in Keycloak release `26.6.4`, alongside several other security bugs including **CVE-2026-9099**, **CVE-2026-9083**, **CVE-2026-9086**, **CVE-2026-9705**, **CVE-2026-9799**, **CVE-2026-9800**, and **CVE-2026-11800**. Red Hat also shipped security updates for its Keycloak `26.4.11` images and operator on OpenShift, addressing a broad set of vulnerabilities across the Admin REST API, Account REST API, OIDC dynamic client registration, UMA authorization, token handling, redirect validation, and scope processing, with impacts ranging from information disclosure and SSRF to account takeover, policy bypass, and denial of service.
Jul 12, 2026
Red Hat disclosed **CVE-2026-4636**, a high-severity flaw in **Keycloak** that lets an authenticated user with the `uma_protection` role bypass **User-Managed Access (UMA)** policy validation. By submitting policy creation requests that reference resource identifiers owned by other users while the URL path points to an attacker-controlled resource, an attacker can obtain a **Requesting Party Token (RPT)** for victim-owned resources. The issue can expose sensitive information and permit unauthorized actions against protected resources; Red Hat linked the vulnerability to advisories **RHSA-2026:6477** and **RHSA-2026:6478**.
Jun 29, 2026