CVE-2026-18963 is a critical security flaw in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat build of Keycloak. The vulnerability allows an unauthenticated attacker to bypass the email verification step normally required during password reset, enabling the attacker to directly set new credentials for any user account. This results in a complete account takeover without requiring any prior authentication or user interaction. Red Hat has issued security advisories and released updated Keycloak images (version 26.4.15) that fix this issue. The vulnerability is tracked under CWE-640 (Weak Password Recovery Mechanism).

An unauthenticated attacker can forcibly reset passwords for arbitrary user accounts without email verification, leading to full account takeover. This compromises confidentiality and integrity of user accounts but does not affect availability. The vulnerability poses a critical risk to identity and access management systems relying on the affected Keycloak versions.

Red Hat has released fixed versions of Red Hat build of Keycloak 26.4.15 that address this vulnerability. Users should back up their existing installations and apply the security updates provided in Red Hat advisories RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524 as soon as possible. No other mitigations are indicated by the vendor advisory.