Intel

CVE-2026-18963

BigFix: Weak Password Recovery Mechanism for Forgotten Password (CVE-2026-18963)

criticalPoCEPSS 3.2%

Affected

  • maven/org.keycloak:keycloak-services 26.0.0..*
  • maven/org.keycloak:keycloak-services 26.0.1..*
  • maven/org.keycloak:keycloak-services 26.0.2..*
  • maven/org.keycloak:keycloak-services 26.0.3..*
  • maven/org.keycloak:keycloak-services 26.0.4..*
  • maven/org.keycloak:keycloak-services 26.0.5..*
  • maven/org.keycloak:keycloak-services 26.0.6..*
  • maven/org.keycloak:keycloak-services 26.0.7..*
  • maven/org.keycloak:keycloak-services 26.0.8..*
  • maven/org.keycloak:keycloak-services 26.1.0..*
  • maven/org.keycloak:keycloak-services 26.1.1..*
  • maven/org.keycloak:keycloak-services 26.1.2..*
  • maven/org.keycloak:keycloak-services 26.1.3..*
  • maven/org.keycloak:keycloak-services 26.1.4..*
  • maven/org.keycloak:keycloak-services 26.1.5..*
  • maven/org.keycloak:keycloak-services 26.2.0..*
  • maven/org.keycloak:keycloak-services 26.2.1..*
  • maven/org.keycloak:keycloak-services 26.2.2..*
  • maven/org.keycloak:keycloak-services 26.2.3..*
  • maven/org.keycloak:keycloak-services 26.2.4..*
  • maven/org.keycloak:keycloak-services 26.2.5..*
  • maven/org.keycloak:keycloak-services 26.3.0..*
  • maven/org.keycloak:keycloak-services 26.3.1..*
  • maven/org.keycloak:keycloak-services 26.3.2..*
  • maven/org.keycloak:keycloak-services 26.3.3..*
  • maven/org.keycloak:keycloak-services 26.3.4..*
  • maven/org.keycloak:keycloak-services 26.3.5..*
  • maven/org.keycloak:keycloak-services 26.4.0..*
  • maven/org.keycloak:keycloak-services 26.4.1..*
  • maven/org.keycloak:keycloak-services 26.4.2..*
  • maven/org.keycloak:keycloak-services 26.4.3..*
  • maven/org.keycloak:keycloak-services 26.4.4..*
  • maven/org.keycloak:keycloak-services 26.4.5..*
  • maven/org.keycloak:keycloak-services 26.4.6..*
  • maven/org.keycloak:keycloak-services 26.4.7..*
  • maven/org.keycloak:keycloak-services 26.5.0..*
  • maven/org.keycloak:keycloak-services 26.5.1..*
  • maven/org.keycloak:keycloak-services 26.5.2..*
  • maven/org.keycloak:keycloak-services 26.5.3..*
  • maven/org.keycloak:keycloak-services 26.5.4..*
  • maven/org.keycloak:keycloak-services 26.5.5..*
  • maven/org.keycloak:keycloak-services 26.5.6..*
  • maven/org.keycloak:keycloak-services 26.5.7..*
  • maven/org.keycloak:keycloak-services 26.6.0..*
  • maven/org.keycloak:keycloak-services 26.6.1..*
  • maven/org.keycloak:keycloak-services 26.6.2..*
  • maven/org.keycloak:keycloak-services 26.6.3..*
  • maven/org.keycloak:keycloak-services 26.6.4..*
  • maven/org.keycloak:keycloak-services 26.7.0..*
  • maven/org.keycloak:keycloak-services 26.7.1..*

Description

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Source: OSV (Open Source Vulnerabilities)siemens_advisorycvelistv5NVD (NIST)BSI WID PortalBSI CSAF

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

HCLBigFix
Service Management v23Service Management <August 29 2006 Hot FixService Management <v27Service Management <v27 Hotfix

Metrics

XIEM Effective CVSS
9.1
Source: nvd-v3
EPSS percentile
87.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
—
Show all metrics
Severity
critical
Priority score
133.93
Exploit maturity
PoC (publicly reported)
CVSS v3
9.1
EPSS score
3.2 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2026-08-25 10:46 UTC
CWE
CWE-640

Weakness classes (CWE)

  • CWE-640Base

    Weak Password Recovery Mechanism for Forgotten Password

    The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-08 09:17 UTC· secalert@redhat.com
    • Reference: https://access.redhat.com/errata/RHSA-2026:56519
    • Reference: https://access.redhat.com/errata/RHSA-2026:56520
    • Reference: https://access.redhat.com/errata/RHSA-2026:56523
    • Reference: https://access.redhat.com/errata/RHSA-2026:56524
  2. CVE Modified2026-09-08 09:17 UTC· 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/18xxx/CVE-2026-18963.json">CVE-2026-18963</a>
    • Reference: https://cert-portal.siemens.com/productcert/html/ssa-503852.html
  3. CVE Modified2026-08-20 14:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-18963","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
  4. CVE Modified2026-08-20 08:16 UTC· secalert@redhat.com
    • Affected: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4 (+10) → Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4 (+10)
  5. CVE Modified2026-08-19 03:16 UTC· secalert@redhat.com
    • Reference: https://access.redhat.com/errata/RHSA-2026:56520
    • Affected: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4 (+8) → Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4 (+10)

Linked advisories