live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
newsIDENTITY

Critical Keycloak flaw turns password recovery into account takeover

Red Hat rates CVE-2026-18963 at 9.1 and says unauthenticated attackers can bypass email verification; fixed builds and a temporary mitigation are available.

Before-and-after Keycloak password recovery showing email verification bypassed, then fixed.
Side by side: what changed
By The News Desk· Aug 25, 2026

A critical flaw in Keycloak’s password-recovery flow can let an unauthenticated remote attacker reset another user’s credentials without the email-verification step. Red Hat rates CVE-2026-18963 at 9.1 and says successful exploitation gives the attacker full control of the targeted account.

The issue matters because password recovery is an exposed identity boundary, not an administrative-only path. Organizations using Keycloak or Red Hat build of Keycloak should treat the update as urgent, particularly where the affected service protects administrator or platform accounts.

What changed

Red Hat traces the flaw to improper state validation in the reset-credentials authentication flow. It says an unauthenticated attacker can force a password reset for any user, bypass the required email-verification link and directly set new credentials. The attack requires no authentication, privileges or user interaction, according to Red Hat’s CVSS assessment.

Upstream Keycloak addressed the issue in Keycloak 26.7.2, released Aug. 19. That release lists CVE-2026-18963 as an unauthenticated account-takeover vulnerability in the reset-credentials flow. It also includes several other security fixes, so operators should review the complete release notes and migration guidance rather than treating this as an isolated patch.

For Red Hat build of Keycloak, Red Hat’s affected-package table shows fixes for the 26.4 and 26.6 streams. Updated server builds include 26.4.15 and 26.6.6, with related operator bundles and container images covered by Red Hat security advisories dated Aug. 18.

Who is affected

The vulnerable component is keycloak-services, the core identity and access-management engine used by Red Hat build of Keycloak. Red Hat says previous versions in listed product streams should be assumed vulnerable unless explicitly marked otherwise.

The practical risk extends beyond the identity server itself: taking over an account can expose every application and platform permission assigned to that identity. Administrative accounts make the consequence especially severe.

What operators should do

Upgrade upstream deployments to Keycloak 26.7.2 or move Red Hat deployments to the fixed build and container versions listed in the advisory. Validate the upgrade against the Keycloak migration guide and confirm that every running image—not only the operator—is updated.

If an immediate upgrade is not possible, Red Hat’s temporary mitigation is to disable Forgot password in every realm: Realm settings → Login → Forgot password → Off. The setting must be applied realm by realm. Red Hat explicitly recommends upgrading to a fixed version as soon as possible, so disabling recovery should be treated as a short-lived containment step, not the final fix.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk