Keycloak Reset Path Finder

Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations.

Summary

This template helps identify reachable password reset flows that may be relevant during validation of environments affected by:

• CVE-2026-18963
• Keycloak unauthenticated account takeover via reset-credentials flow bypass

According to the public Keycloak issue, the vulnerability allows an unauthenticated attacker to force the password reset process for a user without requiring the expected email verification link, potentially leading to full account takeover.

Reference:

• https://github.com/keycloak/keycloak/issues/51833

Usage

nuclei -t reset-path-finder.yaml -u https://target.example

Notes

• This template is focused on endpoint discovery.
• It does not perform account takeover or password reset completion.
• Review findings manually to confirm exposure and applicability.