A security flaw exists in the reset-credentials flow of the keycloak-services component within Red Hat build of Keycloak 26.4. The vulnerability allows unauthenticated attackers to bypass the email verification link normally required during password reset, enabling them to forcibly reset passwords for arbitrary user accounts. This can lead to complete account takeover by setting new credentials without user consent. The issue is tracked as CVE-2026-18963 and has a CVSS 3.1 score of 9.1 (critical). Red Hat has issued security advisories and released fixed versions starting with 26.4.15 to mitigate this vulnerability.

An unauthenticated attacker can exploit this vulnerability to reset passwords for any user account without completing the email verification step. This effectively allows the attacker to take full control of targeted user accounts by setting new credentials, compromising confidentiality and integrity of user identities. The vulnerability does not impact availability. The CVSS score of 9.1 reflects the critical nature of this flaw with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Red Hat has released fixed versions of Red Hat build of Keycloak starting with 26.4.15, 26.6.6, and 26.7.2 that address this vulnerability. Users should apply these security updates promptly. Before updating, back up existing installations including applications, configuration files, and databases. No alternative mitigations are indicated in the vendor advisories. Patch status is confirmed by multiple Red Hat security advisories linked in the references.