Two HTTP requests were enough to hijack any Keycloak account, researchers found
CVE-2026-18963 let an unauthenticated attacker force a password reset without the victim ever clicking an email link, including on administrator accounts.
Two requests. That is all it took, according to researchers at Aduneo, to take over an account on a vulnerable Keycloak instance, provided the attacker already knew a username. No password guessing, no phishing link, no interaction from the victim required.
CVE-2026-18963, rated 9.1 on CVSS, comes down to improper state validation in Keycloak's reset-credentials flow. Keycloak is the open source identity and access management platform that a huge number of enterprises and public-sector organizations use to run single sign-on. The bug let an attacker force the password reset process through to completion without the mandatory email verification step ever being satisfied, which opens a direct path to account takeover, administrator accounts included, and the whole thing is trivially scriptable.
Every version below 26.7.2 is affected. The fix shipped on August 19, with public disclosure following on August 24. Organizations running Red Hat Build of Keycloak need version 26.4.15-1 or 26.6.6-1, depending on which stream they track.
No password guessing, no phishing link, no interaction from the victim required.
No evidence of active exploitation has surfaced so far, and no public proof-of-concept exists yet either. That is genuinely good news, but it should not slow down the patching timeline. A bug this simple, two requests, zero authentication, tends to show up inside automated scanning tools within days once details circulate, whether or not a formal exploit gets published first.
For teams that cannot patch immediately, there is a stopgap: disabling the "forgot password" feature across every realm closes the door without requiring an upgrade. It is not a real fix, just a way to buy time while the update gets scheduled properly.
Keycloak's footprint makes the stakes here bigger than a typical single-vendor advisory. It is one of the handful of identity platforms that European public-sector bodies lean on specifically because it is free and self-hostable, which matters when procurement budgets are tight and data residency rules complicate any cloud-hosted alternative. That popularity means a bug this cheap to exploit does not stay confined to a niche user base. Given how central Keycloak sits in a lot of identity architectures, patching this one should not wait for a routine maintenance window.
Based on reporting by The Hacker News.
