CVE-2026-18963 Details.
Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-18963. What It Means.
Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: (1) the tryAnotherWay handler stores a generic "true" selector note not scoped to the execution ID, and (2) ResetCredentialEmail.action() calls context.success() without verifying ACTION_TOKEN_USER_ID.
Affected Product. What Is Hit.
- Vendor
- keycloak
- Product
- Keycloak
FAQ
Common Questions.
Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass. Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: (1) the tryAnotherWay handler stores a generic "true" selector note not scoped to the execution ID, and (2) ResetCredentialEmail.action() calls context.success() without verifying ACTION_TOKEN_USER_ID.
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-18963 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-18963 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Keycloak to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-18963. Atlas does not run a check for it, so nothing here says whether a particular site is affected.