Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Keycloak 26.7.2 - Unauthenticated Account Takeover

The exploit targets a critical vulnerability (CVE-2026-18963) in Keycloak versions 26.0.0 through 26.7.1, enabling unauthenticated attackers to take over user accounts without any prior authentication. The root cause is a logic flaw in the reset-credentials flow, specifically a bypass of the email verification step during password reset. The vulnerable Keycloak builds improperly handle the AUTHENTICATION_SELECTOR_SCREEN_DISPLAYED note, allowing an unauthenticated attacker to trigger the authenticator selection screen tied to the email execution. The emailVerified flag is set and success() is called without validating the action token, which normally ensures the legitimacy of the password reset request. This flaw allows the attacker to reach the update-password required action directly, bypassing the emailed reset link and enabling password reset without user consent or email verification.

Technically, the exploit automates interaction with Keycloak's OpenID Connect discovery endpoints to dynamically discover relevant URLs and form fields, making it resilient to custom themes or configurations. It uses HTTP requests to simulate the reset-password flow, manipulating form parameters such as 'tryAnotherWay=on' to trigger the vulnerable code path. The exploit supports three modes: a non-intrusive check to detect vulnerability without side effects, a user enumeration mode that identifies valid accounts by observing side effects like emailVerified flag changes, and a full takeover mode that resets the password and locks out the legitimate user.

The code is well-structured, leveraging Python dataclasses and enums for clarity, and includes robust error handling for rate limiting and transport errors. It uses standard libraries for HTTP requests and HTML parsing, and dynamically adapts to the target environment. The exploit requires no authentication or prior access, only network reachability to the Keycloak server. Detection can focus on anomalous password reset flows without valid tokens, unusual POST requests to reset endpoints, and sudden password changes without corresponding email notifications. Forensics may reveal unexpected emailVerified flag changes and session cookies issued post-reset without user interaction.

Overall, this exploit demonstrates a sophisticated understanding of Keycloak's internal flows and leverages a subtle logic flaw to achieve account takeover with minimal footprint and no user interaction.

Original Source

Raw Exploit Code

CVE Details: CVE-2026-18963

Keycloak  26.7.2 - Unauthenticated Account Takeover

Threats Tagged 'keycloak 26.6.2'

Filter Threats

Threats Tagged 'keycloak 26.6.2'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Lead Pen Test Professional