{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/red-hat-jboss-enterprise-application-platform-expansion-pack/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-18963"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Red Hat Build of Keycloak","Red Hat JBoss Enterprise Application Platform Expansion Pack"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","identity-management","cve-2026-18963"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eCVE-2026-18963 is a critical vulnerability affecting the keycloak-services component within Red Hat Build of Keycloak and the Red Hat JBoss Enterprise Application Platform (EAP) Expansion Pack. This vulnerability stems from a flaw in the identity and access management engine's reset-credentials flow. An unauthenticated attacker can exploit this weakness to initiate a password reset process for any user in the system. Crucially, the exploit circumvents the requirement for an email-based verification link, allowing the attacker to directly set a new password for the target account. Given its nature as an identity provider, successful exploitation grants the attacker full unauthorized access to target accounts, potentially leading to widespread lateral movement or data exfiltration within an organization's authentication infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target Keycloak instance exposed to the network.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a specific HTTP request targeting the password reset endpoint provided by keycloak-services.\u003c/li\u003e\n\u003cli\u003eAttacker submits the targeted username or identifier through the vulnerable reset-credentials flow.\u003c/li\u003e\n\u003cli\u003eThe Keycloak application fails to validate the necessity of the email verification step due to the logic flaw in the services component.\u003c/li\u003e\n\u003cli\u003eThe application accepts the request and proceeds to the credential update stage.\u003c/li\u003e\n\u003cli\u003eAttacker provides the desired new password for the compromised user account.\u003c/li\u003e\n\u003cli\u003eKeycloak processes the update, overwriting the legitimate user's credentials with the attacker-controlled password.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates as the victim user, achieving full account takeover and subsequent persistent access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability presents a high risk to organizational security, as it allows for trivial and unauthenticated account takeover of any user within the managed realm. This can lead to unauthorized access to sensitive corporate applications, potential exfiltration of proprietary data, and the compromise of administrative accounts that manage the identity provider itself. Because Keycloak often acts as a centralized SSO solution, the impact of a successful attack is magnified across all integrated services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Red Hat Build of Keycloak and Red Hat JBoss EAP Expansion Pack within the environment using asset inventory tools.\u003c/li\u003e\n\u003cli\u003eApply the latest security patches provided by Red Hat for the affected keycloak-services package as soon as they become available.\u003c/li\u003e\n\u003cli\u003eReview authentication and access logs for unusual patterns of password reset requests or unexpected administrative logins.\u003c/li\u003e\n\u003cli\u003ePrioritize the hardening of Keycloak instances by restricting network access to reset endpoints where possible until patching is completed.\u003c/li\u003e\n\u003cli\u003eMonitor for anomalous API traffic or high volumes of POST requests to credential reset endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T18:55:19Z","date_published":"2026-08-18T18:55:19Z","id":"https://feed.craftedsignal.io/briefs/2026-08-keycloak-auth-bypass/","summary":"A critical vulnerability (CVE-2026-18963) in the keycloak-services component allows unauthenticated attackers to hijack user accounts by bypassing password reset verification requirements.","title":"Critical Authentication Bypass in Red Hat Build of Keycloak","url":"https://feed.craftedsignal.io/briefs/2026-08-keycloak-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Red Hat JBoss Enterprise Application Platform Expansion Pack","version":"https://jsonfeed.org/version/1.1"}