Keycloak 26.7.2 - Unauthenticated Account Takeover

The exploit targets a critical vulnerability (CVE-2026-18963) in Keycloak versions 26.0.0 through 26.7.1, enabling unauthenticated attackers to take over user accounts without any prior authentication. The root cause is a logic flaw in the reset-credentials flow, specifically a bypass of the email verification step during password reset. The vulnerable Keycloak builds improperly handle the AUTHENTICATION_SELECTOR_SCREEN_DISPLAYED note, allowing an unauthenticated attacker to trigger the authenticator selection screen tied to the email execution. The emailVerified flag is set and success() is called without validating the action token, which normally ensures the legitimacy of the password reset request. This flaw allows the attacker to reach the update-password required action directly, bypassing the emailed reset link and enabling password reset without user consent or email verification. Technically, the exploit automates interaction with Keycloak's OpenID Connect discovery endpoints to dynamically discover relevant URLs and form fields, making it resilient to custom themes or configurations. It uses HTTP requests to simulate the reset-password flow, manipulating form parameters such as 'tryAnotherWay=on' to trigger the vulnerable code path. The exploit supports three modes: a non-intrusive check to detect vulnerability without side effects, a user enumeration mode that identifies valid accounts by observing side effects like emailVerified flag changes, and a full takeover mode that resets the password and locks out the legitimate user. The code is well-structured, leveraging Python dataclasses and enums for clarity, and includes robust error handling for rate limiting and transport errors. It uses standard libraries for HTTP requests and HTML parsing, and dynamically adapts to the target environment. The exploit requires no authentication or prior access, only network reachability to the Keycloak server. Detection can focus on anomalous password reset flows without valid tokens, unusual POST requests to reset endpoints, and sudden password changes without corresponding email notifications. Forensics may reveal unexpected emailVerified flag changes and session cookies issued post-reset without user interaction. Overall, this exploit demonstrates a sophisticated understanding of Keycloak's internal flows and leverages a subtle logic flaw to achieve account takeover with minimal footprint and no user interaction.

In real-world scenarios, this vulnerability enables attackers to completely compromise user accounts on Keycloak-protected applications without any credentials or prior access. Attackers can reset passwords silently, lock out legitimate users, and gain persistent access to sensitive resources. This can be leveraged in targeted attacks against enterprises using Keycloak for identity and access management, allowing lateral movement, data exfiltration, or privilege escalation within corporate networks. Government agencies and critical infrastructure operators relying on Keycloak for secure authentication are at high risk, as attackers can bypass multi-factor authentication and other controls by exploiting this flaw. The exploit can be integrated into broader attack chains, such as phishing campaigns that identify vulnerable Keycloak instances, followed by automated account takeovers and deployment of malware or ransomware. The ability to enumerate valid users via side effects also aids reconnaissance and targeted spear-phishing. Cascading effects include disruption of user access, loss of trust in authentication systems, and potential regulatory and compliance violations due to unauthorized access. The exploit’s low complexity and unauthenticated nature increase its attractiveness for widespread weaponization and automated scanning campaigns.

Immediate containment requires disabling or restricting access to Keycloak’s password reset endpoints until patches are applied. Organizations should apply the official patches released in Keycloak versions 26.4.15, 26.6.6, and 26.7.2 or upgrade to 26.8.0 or later, which include the fix. Network segmentation should isolate Keycloak servers from untrusted networks, limiting exposure to only trusted clients. Access control policies should enforce strict authentication and authorization on sensitive flows. Detection rules should monitor for unusual POST requests to reset-credentials endpoints without valid tokens, unexpected changes to emailVerified flags, and password resets without corresponding email notifications. SIEM and EDR tools can be tuned to alert on these anomalies. Long-term, organizations should implement multi-factor authentication for password resets, enforce rate limiting and CAPTCHA on reset flows, and conduct regular security audits of identity management systems. Employing anomaly detection on user behavior and integrating threat intelligence feeds can help detect exploitation attempts early.