What Happened
Security researchers disclosed CVE-2026-18963, a critical flaw carrying a CVSS score of 9.1 in Keycloak, the widely deployed open-source identity and access management platform. The root cause lies in improper state validation within the reset-credentials authentication flow Keycloak runs when a user requests a password recovery. By sending a specially crafted request to the reset-credentials endpoint, an attacker forces the authentication session to jump directly to the password update phase, bypassing the action token Keycloak normally emails to verify the request. Because the flaw requires no authentication and no user interaction, an unauthenticated attacker over the network resets the password of any account, including administrative accounts, achieving full takeover. Keycloak fixed the vulnerability in version 26.7.2, one of eight CVEs addressed in the release.
Why This Matters for Canadian Organizations
Keycloak sits behind identity and single sign-on infrastructure at organizations across finance, government, education, and technology, often managing access to internal applications, customer portals, and administrative consoles from a single point of control. A critical, unauthenticated account takeover flaw in this kind of infrastructure gives an attacker a direct path to administrative access without stealing a single credential first. Canadian organizations subject to OSFI Guideline B-13 face an expectation of prompt remediation for critical vulnerabilities in identity infrastructure, and entities handling personal information under PIPEDA carry breach notification duties if exploitation exposes user data. Self-managed Keycloak deployments, common among Canadian universities, municipalities, and mid-market technology firms running Red Hat build variants, carry the direct patching burden rather than relying on a cloud vendor’s remediation timeline.
What to Do
Organizations running self-managed Keycloak or Red Hat SSO build variants should upgrade to version 26.7.2 immediately and confirm the update applies across every clustered instance. Security teams should review authentication logs for unexpected password reset events or anomalous session transitions around the reset-credentials flow, and rotate credentials for administrative accounts as a precaution given the low complexity of exploitation. Full technical detail on the flaw is available from The Hacker News.
