Keycloak Credential Reset Authentication Bypass

Critical vulnerability CVE-2026-18963 in Red Hat Build of Keycloak's keycloak-services component allows unauthenticated attackers to bypass email verification during the password-reset flow and set new passwords for arbitrary users (including administrators); Red Hat published fixes (RHSA-2026:56519/56520/56523/56524) and the advisory provides detection indicators (unexpected UPDATE_PASSWORD without VERIFY_EMAIL, high-volume RESET_PASSWORD attempts, access to reset endpoints), mitigation steps (apply patches, force password resets, revoke sessions) and temporary workarounds (disable built-in reset flow, restrict endpoints, enforce MFA).