Skip to main content
Back to feed
CyberConfirmedHighDevelopingFeatured
8.3

Critical Keycloak vulnerability CVE-2026-18963 enables unauthenticated account takeover

A critical vulnerability in Keycloak allows unauthenticated attackers to bypass password reset verification, potentially granting full control over user and administrative accounts. The flaw specifically circumvents the requirement for emailed action tokens, posing a severe risk to enterprise identity management systems.

The Hacker Newsabout 8 hours agoengCredibility 59%View source

Score Breakdown

Mosaic Score8.3
Confidence0.9
Significance0.8
Source credibility0.6

Intelligence Tags

#keycloak#cve-2026-18963#vulnerability#cybersecurity#identity-management
Source

Related signals

8 found