SecurityThe Hacker Newsabout 3 hours ago
Critical Keycloak Flaw Allows Unauthenticated Account Takeover
1 min read
Red Hat patched CVE-2026-18963, a critical 9.1-rated Keycloak flaw allowing unauthenticated attackers to reset any user's password, including admins. Upstream Keycloak 26.7.2 and Red Hat builds 26.4.15 and 26.6.6 fix it. No exploitation or public exploit exists as of August 24, 2026.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
