CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials bypass

CVE-2026-18963 · Severity: critical · CVSS 9.1 · Published 2026-08-18

Keycloak is an open-source identity and access management system used by organizations to manage user authentication and authorization across applications. This vulnerability allows an attacker to take over any user account without authentication by bypassing the email verification step in the password reset flow, gaining complete control over the target account and all associated resources.

Technologies: org.keycloak:keycloak-services (Maven). Vendors: Maven, Siemens.

Quick answers

Is CVE-2026-18963 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18963 being exploited in the wild.
How severe is CVE-2026-18963?
Critical severity, with a CVSS score of 9.1, published 18 August 2026.
Which products and versions are affected?
org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=26.0.0,fixed=26.4.15; Siemens Industrial Edge Management Cloud all versions; Siemens Industrial Edge Management Pro ≥1.14.9 <1.15.20; Siemens Industrial Edge Management Virtual ≥2.6.0 <2.9.1.
Is there a fix for CVE-2026-18963?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.4.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18963 attacked?
It is attacked over the network.
Am I affected by CVE-2026-18963?
Check whether you run org.keycloak:keycloak-services (Maven), Siemens Industrial Edge Management Cloud, Siemens Industrial Edge Management Pro or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.4.15 or later
    # set org.keycloak:keycloak-services to 26.4.15 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the keycloak-services component, the core identity and access management engine in Keycloak. The reset-credentials flow fails to properly enforce email verification, allowing an unauthenticated attacker to initiate and complete a password reset for any user without clicking the required verification link. This is a weak password recovery mechanism (CWE-640). The attack requires only network access and no authentication or user interaction. An attacker can exploit this to directly set new credentials for any target account, gaining full account control. Patches have been released: version 26.4.15, 26.6.6, and 26.7.2 address the vulnerability in their respective version branches.

Affected products

  • Red Hat Keycloak >= 26.0.0, < 26.4.15; >= 26.5.0, < 26.6.6; >= 26.7.0, < 26.7.2

Identifiers

  • CVE-2026-18963
  • GHSA-4gv3-mc9p-5wqc

Timeline

  • 2026-08-18: disclosed: Advisory published
  • 2026-08-18: patched: Patches released in versions 26.4.15, 26.6.6, and 26.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.