CRITICAL KEYCLOAK PASSWORD RESET FLAW COULD LET UNAUTHENTICATED ATTACKERS TAKE OVER ANY ACCOUNT

Summary from the TLDR InfoSec newsletter

CVE-2026-18963 (CVSS 9.1) lets an unauthenticated attacker send a crafted request to Keycloak's reset-credentials endpoint, bypassing the email verification via recovery token and allowing the attacker to update the account password, enabling full account takeover. Administrators should update Keycloak and disable "Forgot password" in every realm until servers are patched.