The Challenge
On August 19, 2026, Red Hat released Keycloak 26.7.2 to fix CVE-2026-18963, a critical flaw in the password reset mechanism. This vulnerability scored 9.1 on the CVSS scale because it allowed unauthenticated remote attackers to take over any user account without interaction. The issue was due to improper state validation in the reset-credentials authentication flow.
The severity lay in the attacker's ability to send a crafted request to the reset-credentials endpoint, forcing the authentication session directly to the password update phase without requiring the action token usually sent via email. Attackers didn't need credentials, social engineering, or prior access. They could reset passwords for any user, including administrative accounts.
For fintech organizations using Keycloak to manage customer and internal access, this put every account behind the identity provider at risk. As Escape researcher Enzo Mongin noted, when an attacker breaches Keycloak's boundary, "they get into everything sitting behind it," including payment systems, customer databases, and administrative consoles.
The Environment and Constraints
Red Hat, acting as the CVE Numbering Authority for Keycloak vulnerabilities, classified CVE-2026-18963 as CWE-640, a weak password recovery mechanism. It was deemed Critical because exploitation required no authentication or user interaction.
The affected surface was broad. Red Hat ships two product streams: upstream Keycloak and Red Hat build of Keycloak (RHBK). RHBK customers run two active streams, 26.4 and 26.6, plus the newer 26.7 upstream release. Each stream includes standalone server packages and container images.
Red Hat needed to patch three version families simultaneously and publish container images, operator bundles, and traditional RPM packages. The fix had to work across every realm configuration where the "Forgot password" feature was enabled.
As of August 24, 2026, no public exploit had been verified, and no evidence of active exploitation existed. This gave Red Hat a narrow window to patch before proof-of-concept code surfaced.
The Approach Taken
Red Hat issued four security errata on August 18, 2026, one day before the upstream 26.7.2 release. The errata covered RHBK 26.4 and 26.6 streams:
- RHBK 26.4 was fixed in operator bundle 26.4.15-1 and container images 26.4-23.
- RHBK 26.6 was fixed in operator bundle 26.6.6-1 and container images 26.6-12.
- Upstream Keycloak was fixed in 26.7.2.
The fix addressed state management in the reset-credentials flow. Red Hat's advisory noted the flaw stemmed from how the flow's state was validated. The patch ensured the authentication session couldn't skip the action token verification step.
For customers who couldn't patch immediately, Red Hat published a temporary mitigation: disable the "Forgot password" functionality in every realm. The setting is found under Realm settings, then Login, then Forgot password in the RHBK administration console. Red Hat emphasized that the setting must be applied to every realm individually and that customers should upgrade as soon as possible.
The company credited James Paremain with reporting the flaw but didn't publish details about the disclosure timeline or whether a coordinated disclosure process was followed.
Results and Metrics
Red Hat shipped patches for all supported RHBK streams within 72 hours of the upstream release. The errata covered standalone packages and container images, giving customers multiple deployment paths.
The GitHub advisory for CVE-2026-18963 listed both affected and patched versions as unknown, meaning customers had to rely on Red Hat's product-specific guidance. The CVE record initially listed Red Hat Single Sign-On 7 as unaffected and the JBoss Enterprise Application Platform Expansion Pack as affected, but later revisions narrowed the product list. The current status of both products isn't established in public sources.
CVE-2026-18963 was one of eight CVE identifiers fixed in Keycloak 26.7.2. The same release addressed CVE-2026-15571, a predictable account-linking hash that also enabled account takeover through malicious OpenID Connect clients. Two weeks earlier, Keycloak 26.7.1 had shipped fixes for twelve CVEs, including a SAML broker login bypass and a default client registration policy that allowed role forgery.
This rapid release cadence suggests Red Hat prioritized identity and access management vulnerabilities, particularly those enabling account takeover without authentication.
What They Would Do Differently
No published source addresses whether the fix fully resolves the flaw or whether certain reset-credentials flow configurations remain vulnerable. Red Hat's advisory doesn't specify if every realm with the forgotten-password feature enabled was exploitable or only certain configurations.
The temporary mitigation requires manual changes to every realm. For organizations running dozens or hundreds of realms, this creates operational risk. A centralized toggle or API-driven mitigation would reduce the chance of missing a realm during emergency response.
The GitHub advisory's "unknown" version listings highlight a gap in vulnerability disclosure for multi-product ecosystems. When a vendor ships multiple builds of the same upstream project, customers need clear mappings between CVE identifiers and product versions. The initial confusion about Red Hat Single Sign-On 7 and JBoss EAP Expansion Pack status shows how version ambiguity delays patch prioritization.
Takeaways for Your Team
If you're running Keycloak or any identity provider in a fintech environment, treat IAM vulnerabilities as payment system vulnerabilities. An attacker who controls authentication controls everything behind it.
Build a patch deployment pipeline for identity infrastructure that matches your payment processing SLA. Red Hat shipped fixes in 72 hours. Your deployment window should be measured in hours, not weeks.
Maintain a realm inventory with configuration states. When Red Hat says "disable Forgot password in every realm," you need to know how many realms you operate and which ones enable password recovery. If you're discovering realms during an incident, your change control process has failed.
For critical IAM patches, don't wait for public exploits. CVE-2026-18963 scored 9.1 and required no authentication. The absence of a public exploit on August 24 doesn't mean one won't surface on August 25.
Review your Multi-Factor Authentication enrollment flows and account recovery mechanisms quarterly. Red Hat fixed twelve CVEs in August 5's release and eight more on August 19. Identity systems are under sustained scrutiny. If your last IAM security review was six months ago, you're behind.
Finally, test your emergency mitigation procedures. Disabling password recovery across all realms is a blunt instrument that affects customer experience. Know in advance whether your support team can handle password resets manually and for how long.
