Keycloak account takeover PoC exposed
A public exploit for CVE-2026-18963 lets unauthenticated attackers hijack Keycloak accounts via the 'Forgot password' feature; patch to 26.7.2.
ANSSI/CERT-FR has published an advisory covering multiple vulnerabilities in Keycloak, the open-source identity and access management platform, affecting versions prior to 26.7.2. The vulnerabilities allow an attacker to bypass security policies and trigger other unspecified security issues. Most significantly, a public proof-of-concept exists for CVE-2026-18963, which allows an unauthenticated attacker who knows a victim's account identifier to take over that account, leveraging the 'Forgot password' account recovery flow.
Red Hat, which maintains Keycloak, recommends disabling the 'Forgot password' functionality across all authentication realms as a temporary mitigation for organizations unable to immediately patch; this feature is not enabled by default, which limits blast radius for unaffected deployments. Seven additional CVEs (CVE-2026-14613, CVE-2026-15571, CVE-2026-15945, CVE-2026-17048, CVE-2026-45292, CVE-2026-59888, CVE-2026-59889) are also referenced without detailed descriptions, indicating unspecified security issues bundled in the same release.
Given the availability of a public PoC for an unauthenticated account-takeover vulnerability in a widely deployed identity provider, defenders running Keycloak should prioritize upgrading to version 26.7.2 or later, or apply the documented workaround if patching is delayed. Organizations should also audit whether 'Forgot password' is enabled in their realms and monitor authentication logs for anomalous password-reset activity.
Mentioned in this report
Detection guidance
Keycloak Forgot Password Flow Abuse
Detects multiple password reset requests for the same user account within a short timeframe, indicative of account takeover attempts via the forgot-password vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Keycloak Forgot Password Flow Abuse
description: Detects suspicious patterns in Keycloak password reset requests - multiple
resets for the same account or bulk reset requests within short intervals, consistent
with CVE-2026-18963 account takeover attempts via the forgot-password flow.
tags:
- attack.t1078
logsource:
category: application
product: keycloak
detection:
selection_password_reset:
event_type: PASSWORD_RESET_REQUESTED
selection_bulk_or_repeated:
- user_id|contains|all:
- user_id
- realm: '*'
filter_legitimate:
source_ip: 10.0.0.0/8
condition: selection_password_reset and selection_bulk_or_repeated and not filter_legitimate
falsepositives:
- Users legitimately clicking forgot-password multiple times due to UI confusion
- Bulk password reset campaigns by administrators across multiple users
level: medium
id: 3998de5f-4109-573b-8c43-297ace7415ce
status: experimental
author: Vorant
Keycloak Unauthenticated Password Reset Token Generation
Detects password reset token generation triggered without prior successful authentication, matching the unauthenticated account-takeover pattern in CVE-2026-18963. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Keycloak Unauthenticated Password Reset Token Generation
description: Detects password reset token creation in Keycloak initiated without preceding
user authentication, consistent with the CVE-2026-18963 unauthenticated account-takeover
vulnerability that exploits the forgot-password flow.
tags:
- attack.t1078
logsource:
category: application
product: keycloak
detection:
selection:
event_type: PASSWORD_RESET_TOKEN_GENERATED
authenticated_user: null
filter_admin_realm_management:
user_id|contains: realm-management-client
condition: selection and not filter_admin_realm_management
falsepositives:
- Legitimate password-reset flows initiated from login page (no prior session required)
- Automated account provisioning tools triggering password setup tokens
level: medium
id: 5f9d79d8-842f-5d81-9c64-5561e00119b6
status: experimental
author: Vorant
Keycloak Account Takeover via Password Reset Completion
Detects successful password changes following password reset token usage without credential verification, indicating potential account takeover completion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Keycloak Account Takeover via Password Reset Completion
description: Detects password successfully changed via reset token with no prior authentication
context for the account, consistent with CVE-2026-18963 account-takeover exploitation
where an attacker completes the password reset initiated by the forgot-password
vulnerability.
tags:
- attack.t1078
logsource:
category: application
product: keycloak
detection:
selection:
event_type: UPDATE_PASSWORD
context_authentication_method: reset_token
user_session_duration_ms: 0
filter_expected_resets:
realm|contains: staging
condition: selection and not filter_expected_resets
falsepositives:
- Legitimate user-initiated password reset via email link during initial account setup
- Password reset completed immediately after clicking reset email link
level: high
id: 2348a762-f75c-5ca3-83af-33eb154823b6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1078
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free