Keycloak CVE-2026-18963 Bypasses Action Token in Reset-Credentials Flow

Red Hat assigned CVE-2026-18963 after tracing the defect to improper state validation inside the reset-credentials authentication flow. A crafted request advances the session directly to the password-update step, skipping the token check entirely. The flaw affects upstream Keycloak before 26.7.2 and Red Hat builds 26.4.15 and 26.6.6. Four errata issued 18 August 2026 list the fixed container images and operator bundles. No public exploit or confirmed in-the-wild use has been recorded as of 24 August. The same 26.7.2 release also closed CVE-2026-15571, a predictable account-linking hash. Two weeks earlier, 26.7.1 fixed twelve additional CVEs covering SAML broker bypass and dynamic client-registration role forgery. This cluster of authentication-flow defects indicates repeated failures to enforce session state across multiple entry points. Escape researcher Enzo Mongin previously noted that boundary crossings in Keycloak grant access to every downstream application trusting its tokens. Temporary mitigation requires disabling the forgot-password toggle in every realm, a change that removes user self-service recovery and must be applied uniformly. Procurement records show Keycloak is embedded in several government and enterprise identity platforms; the same pattern of unpatched boundary flaws appears in earlier Red Hat Single Sign-On advisories. Independent verification of the revised product list on NVD remains incomplete. Operators should prioritize upgrade to the listed fixed versions over the next 30 days. Continued monitoring of reset-credentials endpoint logs for anomalous state transitions will surface attempted exploitation before widespread scanning begins.