As cited
Copy frozen at (site build).
vulnerabilities
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat and the Keycloak project released patches for a critical vulnerability (CVE-2026-18963) in the open-source identity and access management server. An unauthenticated remote attacker could exploit the flaw to reset passwords and take over any user account, with a CVSS score of 9.1.
Why it matters: Organizations running Keycloak for authentication and access control face immediate account takeover risk from unauthenticated attackers; patching should be prioritized today.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat and the Keycloak project released patches for a critical vulnerability (CVE-2026-18963) in the open-source identity and access management server. An unauthenticated remote attacker could exploit the flaw to reset passwords and take over any user account, with a CVSS score of 9.1.
Why it matters: Organizations running Keycloak for authentication and access control face immediate account takeover risk from unauthenticated attackers; patching should be prioritized today.
- Source published
- First seen by Cybersecurity Tracker