{"cve":{"cve_id":"CVE-2026-18963","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.03177,"epss_percentile":0.87828,"epss_as_of":"2026-10-15","description":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.","published_at":"2026-08-18T17:05:07.478000Z","last_modified_at":"2026-10-23T17:17:21.527000Z","cvss_v3_score":9.1,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_v3_severity":"CRITICAL","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"none","ssvc_automatable":true,"ssvc_technical_impact":"total","cwes":["CWE-640"],"nvd_references":["https://access.redhat.com/errata/RHSA-2026:56519","https://access.redhat.com/errata/RHSA-2026:56520","https://access.redhat.com/errata/RHSA-2026:56523","https://access.redhat.com/errata/RHSA-2026:56524","https://access.redhat.com/security/cve/CVE-2026-18963","https://bugzilla.redhat.com/show_bug.cgi?id=2511595"],"vuln_status":"Awaiting Analysis","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-08-18T18:42:27.512848Z","updated_at":"2026-10-25T12:33:38.660090Z"},"effective_severity":"CRITICAL","badges":["exploit","news"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[],"exploit_refs":[{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/52699","title":"Keycloak  26.7.2 - Unauthenticated Account Takeover","author":"Abel Maldonado","disclosed_at":"2026-10-21"},{"source":"nuclei","kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml","title":"Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass","author":"DhiyaneshDk","disclosed_at":null}],"news":[{"id":1356,"source":"The Hacker News","url":"https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html","title":"Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account","summary":"Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.\n\nThe vulnerability, assigned the CVE identifier&nbsp;CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhB3jURz2EzucPTALqHju1yDNnbHFvawrKxEfvNEprkdA3QIDyOjuUqvHOyTyiZuYJR-4KwewHnd8CdT37TDxBMBK3OLknOxym2a0klblR6rNUc2lqXHdAQUl1JO8uE7bGupO-WqsaEM0UDLUGyWICu5fkA6x4GwNUCo_w3quxp8joYWhNX8grP55eVg8/s1600/keylock.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-08-24T11:56:34Z","fetched_at":"2026-08-24T12:10:27.828420Z","trending_score":3.958956140508026e-10,"cve_ids":["CVE-2026-18963"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:56519","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56520","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56523","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56524","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18963","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511595","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2026-08-18T17:05:07.478000Z","label":"CVE published","source":null},{"type":"ssvc_changed","at":"2026-08-20T23:43:27.516852Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-20T23:43:27.516852Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-20T23:43:27.516852Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"first_article","at":"2026-08-24T11:56:34Z","label":"First news coverage","source":"The Hacker News"},{"type":"poc_available","at":"2026-08-25T19:35:20.264041Z","label":"Public PoC available","source":"nuclei"},{"type":"exploit_known","at":"2026-10-21T00:00:00Z","label":"Public exploit available","source":"exploit-db"}]}