CyberSecurity News

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

The Hacker News

· August 24, 2026

AI summary

A critical security flaw has been discovered in the Keycloak identity and access management server, which could be exploited by an unauthenticated remote attacker to take over any user account by forcing a password reset. Red Hat and the Keycloak project have released patches to address this vulnerability. The flaw is rated 9.1 on the CVSS scoring system by Red Hat, indicating a high level of severity. The vulnerability has been assigned the CVE identifier CVE-2026-18963.

Vulnerabilities mentioned

CVE-2026-18963

CRITICAL

CVSS 9.1

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Read the full article at The Hacker Newsthehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.