Executive Summary
A critical authentication bypass vulnerability (CVE-2026-18963, CVSS v3.1 score 9.1) has been uncovered in Keycloak, the widely deployed open-source identity and access management (IAM) platform maintained by Red Hat and the Cloud Native Computing Foundation (CNCF) community. The flaw resides directly within the credential reset execution workflow (reset-credentials), allowing remote, unauthenticated attackers to bypass the mandatory email token verification step and directly submit new passwords for arbitrary target accounts.
Because Keycloak serves as the central identity provider for thousands of enterprise single sign-on (SSO) ecosystems, Kubernetes clusters, and cloud-native applications, exploitation of this vulnerability enables immediate privilege escalation and full account takeover (ATO), including master administrative realms. The Keycloak project has issued emergency releases in Keycloak 26.7.2 to address the defect.
Technical Deep-Dive & Root-Cause Analysis
The vulnerability stems from a logical flaw in the state-machine evaluation within the keycloak-services core authentication engine. When a password reset is initiated via the default browser-based flow:
* Intended Execution Model: A user enters their username/email, triggering Keycloak to generate a cryptographic action token, persist a transient execution state in the user session cache, and dispatch a verification link via SMTP. The client must present this signed action token before the server advances the execution context to the credential update form (UPDATE_PASSWORD).
* State Validation Flaw: Due to improper boundary validation during multi-step authentication sub-flows, an attacker can manipulate the HTTP POST request sent to the /auth/realms/{realm}/login-actions/reset-credentials endpoint. By submitting crafted execution parameters that emulate an already-validated session state while omitting the action token check, the underlying ResetPassword authenticator fails to verify whether the email link was ever delivered or clicked.
* Execution Path: The server incorrectly transitions the authentication state to completed, accepting the attacker's newly supplied password parameters. Consequently, an attacker possessing only a valid username or email address can overwrite existing credentials without requiring access to the victim's inbox or any secondary verification factors.
Attack Surface and Industry Impact
Keycloak is standard infrastructure across modern microservice environments, Docker/Kubernetes deployments, and enterprise API gateways:
* Blast Radius: Organizations relying on Keycloak for OAuth2, OpenID Connect (OIDC), and SAML 2.0 federation face immediate exposure. Compromising a single administrative identity allows attackers to forge client tokens, dump user directories, modify role-based access control (RBAC) policies, and pivot into downstream SaaS platforms.
* Automated Exploitation: Because the attack requires no specialized tooling beyond standard HTTP request crafting and no prior authentication, automated botnets and initial access brokers (IABs) can rapidly scan and exploit public-facing Keycloak endpoints.
Mitigation & Remediation Guidelines
Security administrators and DevOps teams must execute the following remediation measures immediately:
1. Apply Official Patches: Upgrade all production and staging Keycloak instances to Keycloak 26.7.2, 26.4.5, or the latest supported vendor release (e.g., Red Hat build of Keycloak).
2. Temporary Workaround (Flow Modification): If immediate patching is not possible, navigate to the Keycloak Admin Console -> Authentication -> Flows -> Reset Credentials. Reconfigure the flow by setting conditional execution rules or temporarily disabling the self-service password reset feature (Reset Credentials flow set to Disabled).
3. Enforce Multi-Factor Authentication (MFA): Require WebAuthn/FIDO2 hardware keys or TOTP authenticators for all administrative accounts, preventing single-factor password takeover from granting immediate access.
4. Audit Authentication Logs: Review server access logs for anomalous POST requests directed at login-actions/reset-credentials that succeed with minimal latency between initiation and credential submission.