Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Today’s signal The Hacker News recently reported Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account. Published context: August 24, 2026. Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring syste ...