EUVD-2026-61063
GHSA-4gv3-mc9p-5wqc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote reset-credentials bypass with no user interaction gives AV:N/AC:L/PR:N/UI:N; full account takeover yields C:H/I:H, and no service disruption gives A:N.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3Blast Radius
ecosystem impact- 28 maven packages depend on org.keycloak:keycloak-services (20 direct, 8 indirect)
Ecosystem-wide dependent count for version 26.0.0.
DescriptionCVE.org
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Articles & Coverage 3
AnalysisAI
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Keycloak is a widely used open-source identity and access management (IAM) server; keycloak-services is its core engine handling authentication flows, and Red Hat ships it as Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and within the JBoss EAP Expansion Pack (per the provided CPE strings). The root cause maps to CWE-640 (Weak Password Recovery Mechanism): the reset-credentials flow is supposed to require proof of email ownership via a one-time verification link, but the state machine allows the reset to proceed and a new password to be set without that link being followed. In effect the email-verification step, which is the authentication factor protecting the recovery process, is not enforced as a hard gate.
RemediationAI
Consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-18963) and Bugzilla 2511595 (https://bugzilla.redhat.com/show_bug.cgi?id=2511595) and apply the vendor-supplied errata/update for your product stream as soon as it is published - no exact fixed version is stated in the available data, so no vendor-released patch version can be independently confirmed at time of analysis. As a compensating control until patched, restrict or disable the self-service 'Forgot password' / reset-credentials flow in affected realms (Realm Settings → Login → 'Forgot password' off), which stops the bypass but removes self-service recovery and shifts resets to administrators. Additionally, place the Keycloak account/login endpoints behind network or WAF restrictions and rate-limiting, tighten the reset-credentials authentication flow to hard-require the email verification execution, and monitor for anomalous CREDENTIAL_RESET / UPDATE_PASSWORD events in Keycloak audit logs so any exploitation attempts are detected; these controls reduce exposure at the cost of degraded user self-service.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today