Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat and the Keycloak project disclosed and patched CVE-2026-18963, a critical (CVSS 9.1) improper state validation flaw in the reset-credentials flow that allows unauthenticated attackers to force password resets and fully takeover any user account (including admins). Fixed releases (upstream Keycloak 26.7.2 and Red Hat build updates) and a mitigation (disable the "Forgot password" feature per-realm) were published; no verified exploitation has been reported as of Aug 24, 2026.