Critical Keycloak Flaw (CVE-2026-18963) Exposes Cloud Identity Realms to Account Takeover

Red Hat and the open-source Keycloak project released security updates addressing CVE-2026-18963, a critical CVSS 9.1 authentication bypass vulnerability affecting the keycloak-services core component. The flaw stems from improper state validation in the reset-credentials flow, allowing an unauthenticated remote attacker to force the credential reset sequence and set new passwords on target accounts without completing or consuming the mandatory email verification action token. Fixed releases include Keycloak 26.7.2 as well as Red Hat Build of Keycloak (RHBK) versions 26.4.15 and 26.6.6. Because Keycloak sits at the perimeter of application authentication, issuing OpenID Connect (OIDC) tokens and SAML assertions to dependent backend systems, an account takeover at the IdP level compromises all downstream services. Attackers do not need prior privileges, valid credentials, or user interaction to execute this exploit. Any publicly reachable Keycloak realm with the "Forgot password" mechanism enabled is exposed, meaning privileged administrative accounts and end-user profiles alike face immediate compromise if their username or email address is known or discoverable through standard enumeration. This incident highlights an ongoing architectural risk across cloud-native environments: the centralization of trust within modern identity and access management (IAM) fabrics. While centralized identity simplifies OAuth/OIDC delegation, zero trust policy enforcement, and single sign-on across distributed microservices, it also aggregates blast radius. In recent years, complex multi-step authentication state machines—such as passkey enrollment, federated broker logins, and dynamic credential recovery flows—have become prime targets for logic and state-bypass vulnerabilities. When state transitions fail to strictly enforce antecedent validation tokens before finalizing state mutations, peripheral network firewalls and API gateways offer zero defense. Practitioners running self-hosted or containerized Keycloak instances should immediately upgrade to version 26.7.2 or the relevant RHBK maintenance patch. If immediate deployment is hindered by change-freeze windows or verification testing cycles, administrators must temporarily disable the "Forgot password" setting across all active realm login configurations in the Keycloak admin console. Security operations teams should review Keycloak audit events for anomalous UPDATE_PASSWORD actions lacking preceding VERIFY_EMAIL or action token consumption markers, alongside tracking spikes in password reset requests originating from single IP blocks.