CVE-2026-18963 Scanner
CVE-2026-18963 Scanner - Unauthorized Account Takeover vulnerability in Keycloak
Used 5 times · 5.9k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-18963
9.1
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
red hat build of keycloak 26.4red hat build of keycloak 26.4.15red hat build of keycloak 26.6red hat build of keycloak 26.6.6red hat jboss enterprise application platform expansion packred hat single sign-on 7
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: red hat build of keycloak 26.4
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →