Do Son 
TL;DR
Keycloak 26.7.2 fixes five flaws, released on August 19, 2026. The most severe, CVE-2026-18963, allows a Keycloak account takeover with no login. It scores 9.1 on the CVSS scale.
- Total: 5 CVEs
- Severity: 1 Critical · 1 High · 3 Medium
- Actively exploited: None confirmed
- Exploit Intel (PatchThis): 1 of 5 confirmed
- Highest severity: 9.1 (Critical · CVSSv3) — CVE-2026-18963
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status | PoC |
|---|---|---|---|---|---|
| CVE-2026-18963 | 9.1 | CWE-640 | 26.4.15-1, 26.4-23, 26.6.6-1 (+1) | Not exploited | Available (Nuclei) |
| CVE-2026-15571 | 7.3 | CWE-341 | 26.6.6-1, 26.6-12 | Not exploited | — |
| CVE-2026-17048 | 5.5 | CWE-200 | 26.6.6-1, 26.6-12 | Not exploited | — |
| CVE-2026-15945 | 4.3 | CWE-639 | 26.6.7-3, 26.6-20 | Not exploited | — |
| CVE-2026-14613 | 4.3 | CWE-1220 | 26.6.6-1, 26.6-12 | Not exploited | — |
Why it matters
Keycloak is a widely used open-source identity platform. It also ships as the Red Hat Build of Keycloak. Because it guards logins for many apps, an account takeover here can unlock everything behind it.
How the attacks work
The two worst flaws both lead to full account compromise.
CVE-2026-18963: reset-credentials bypass
This is the headline bug, rated 9.1. It sits in the reset-credentials flow of the core services engine. An unauthenticated attacker can force a password reset for any user without clicking the email verification link. As a result, the attacker sets new credentials and seizes the account.
CVE-2026-15571: predictable linking hash
This flaw, scored 7.3, hits the legacy account-linking endpoint. The protective hash can be predicted by a malicious OIDC client. After luring a user to authenticate, the client forges a valid linking URL and takes over the account.
Lower-severity issues
Three further flaws expose data to over-privileged admins. CVE-2026-17048 leaks vault-resolved client secrets. CVE-2026-15945 and CVE-2026-14613 disclose hidden groups under Fine-Grained Admin Permissions v2.
Affected versions
The fixes ship in Keycloak 26.7.2. The advisory references the 26.6.3 line among affected builds. No public exploitation or proof-of-concept has been confirmed for this Keycloak account takeover chain.
Patch and mitigation
Update now. The Keycloak 26.7.2 release notes list every fix. Upgrading is the clear path, since no workarounds are offered. Review the migration guide before you deploy.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
