CVE-2026-18963 Keycloak Unauthenticated Account Takeover

★ CVE-2026-18963 Keycloak Reset-Credentials Flow Bypass PoC ★

https://github.com/user-attachments/assets/ebed1e64-a40c-4333-be18-9acbadd655b0

Overview

CVE-2026-18963 is a critical unauthenticated account takeover vulnerability in the Keycloak keycloak-services component (CVSS 9.1). A flaw in the reset-credentials authentication state machine allows a remote attacker to bypass the email-verification step and reach the password-update form without possessing the reset link. By targeting a known username, an attacker can set a new password and take control of the victim's account without authentication or user interaction.

The vulnerable flow stores the credential-selector state as a session-wide authentication note instead of binding it to the execution that displayed the selector. Re-entering the reset flow can therefore reuse stale selector state for another execution. In affected versions, the reset-email authenticator also accepts an action without confirming that it was reached through a valid email action token. Chaining these behaviors advances the attacker directly to UPDATE_PASSWORD.

Affected Versions

Category	Version
Vulnerable	Keycloak 26.0.0 ≤ version < 26.4.15
Vulnerable	Keycloak 26.5.0 ≤ version < 26.6.6
Vulnerable	Keycloak 26.7.0 ≤ version < 26.7.2
Patched	26.4.15, 26.6.6, 26.7.2 (respective release branches)

This lab uses Keycloak 26.7.1.

Impact

• Unauthenticated password reset for an arbitrary known user
• Full account takeover without access to the victim's email
• Unauthorized access to applications and data protected by the affected Keycloak realm
• Abuse of the victim's roles and privileges in connected services

Environment

Build and run the vulnerable Keycloak 26.7.1 environment. The image imports a test realm with the vulnerable reset-credentials flow enabled, a seeded victim account, and an EQST portal with a protected flag page.

docker build -t cve-2026-18963 .
docker run --rm -d \
  --name cve-2026-18963 \
  -p 9105:9105 \
  -e PORTAL_PUBLIC_URL=http://127.0.0.1:9105 \
  cve-2026-18963

Wait for Keycloak to start, then open the portal:

http://127.0.0.1:9105

Precondition	State in this lab
Keycloak	26.7.1 (vulnerable)
Realm	cve-lab
Forgot password	enabled
Target account	victim
Keycloak base URL	http://127.0.0.1:9105/keycloak

PoC

The included exploit.py automates the reset-flow state manipulation, requests the password-update form without consuming an email action token, changes the victim's password, and verifies the takeover by requesting an access token with the new credentials.

Install the Python dependency:

python3 -m pip install requests

Run the exploit with the Keycloak URL, victim username, and a new password:

# python3 exploit.py <keycloak-url> <victim> <new-password>
python3 exploit.py \
  http://127.0.0.1:9105/keycloak \
  victim \
  'NewPassword1!'

A successful run prints:

[*] selector note set via tryAnotherWay
[*] victim submitted: victim
[*] update-password form served without an action token
[+] VULNERABLE - victim password is now 'NewPassword1!'

Open http://127.0.0.1:9105, click LOGIN, and authenticate as victim with the new password to confirm the account takeover.

Mitigation

• Upgrade within the applicable release branch to 26.4.15, 26.6.6, or 26.7.2, or move to a newer supported Keycloak release.
• If an immediate upgrade is not possible, disable Realm settings → Login → Forgot password in every realm as a temporary mitigation.
• Review password-reset activity for unexpected resets and investigate affected accounts.
• Revoke active sessions and rotate credentials for accounts suspected of compromise.

Analysis

• KR: Coming soon!
• EN: