🔴 Critical: Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
-
Patches are now available for a critical vulnerability in Keycloak, the open-source identity and access management platform. The flaw, tracked as CVE-2026-18963 and rated 9.1 on the CVSS scale by Red Hat, could allow an unauthenticated remote attacker to force a password reset and subsequently take over any user account within the system.
The issue lies in the password reset flow, where a lack of proper validation or authentication checks permits malicious actors to initiate the process without valid credentials. Because Keycloak is widely deployed as a central authentication hub for enterprises, a successful exploit could grant an attacker unauthorized access to connected applications and sensitive data.
The coordinated patches were released by both the Keycloak project and Red Hat. Administrators are strongly urged to take immediate action to mitigate the risk:
- Apply the latest updates to Keycloak servers without delay.
- Review access logs for any suspicious password reset requests or unexpected account lockouts.
- Consider enforcing additional verification steps for password reset operations, such as OTP or email confirmation, if not already configured.
Given the severity and the unauthenticated nature of the attack, proper patching is the primary defense. Ensure your deployment is updated to a fixed version as soon as possible.
Source: The Hacker News
Has your team already applied the patches, or are you waiting on a maintenance window to roll these out?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login