A critical flaw in Keycloak, one of the most widely used open-source identity and login systems, lets an attacker reset any user's password — including administrator accounts — without ever proving who they are. Tracked as CVE-2026-18963 and rated 9.1 out of 10 on the CVSS scale, the bug sits in the "reset-credentials" flow: the multi-step process Keycloak runs when someone clicks "Forgot password". Normally that flow only lets you set a new password after you click a link sent to your registered email. This flaw lets an attacker skip that verification step entirely by manipulating the sequence of requests, landing directly at the password-set screen for any username they choose.
No login, no stolen credentials, and no action from the victim are required — the attacker only needs to know or guess a valid username, which is often just an email address. Because the flow never gets to the point of actually sending an email, the real account owner has no indication anything happened until their password stops working. Keycloak's maintainers and Red Hat, which ships Keycloak inside several of its identity products, have both published advisories and fixed versions: upstream Keycloak 26.7.2, and Red Hat's own builds at 26.4.15 and 26.6.6 or later.
What this means for your business
- If your organisation runs Keycloak — directly, through Red Hat's build, or bundled inside another product — check your version now and upgrade to a fixed release (26.7.2 or later, or the matching Red Hat build) as soon as you can.
- If an immediate upgrade isn't possible, temporarily disable the "Forgot password" / self-service reset option in your Keycloak realm settings. It closes the hole at the cost of routing legitimate resets through an admin instead.
- Once patched, review recent password-reset activity in your Keycloak admin logs for resets that don't line up with a real support request, especially on privileged or admin accounts.
- This is a good prompt to check whether any account on your identity system has 2FA available but not enforced — a resolved password-reset bug still leaves accounts exposed if a similar flaw surfaces again and there's no second factor behind it.
- If you don't manage your own identity infrastructure, ask whoever hosts your login system (your web/app vendor or IT provider) whether Keycloak sits anywhere in that stack and whether it's been patched.
Identity and login systems are the front door to everything else a business runs — CRM, internal tools, customer portals — so a flaw that hands out that door's master key without a password is worth treating as urgent even if nothing has been reported stolen yet.