CVE-2026-18963: Keycloak reset flow lets anyone hijack accounts, no email pop needed
A critical bug in Keycloak's reset-credentials flow (CVE-2026-18963, CVSS 9.1) lets an unauthenticated attacker force a password reset on any user — including admins — by skipping the emailed verification token altogether. The flawed state validation jumps straight to the password-update phase, so a crafted request hands over the whole account. No exploits are public yet, but anyone running the IAM server should move to 26.7.2 (or RHBK 26.4.15/26.6.6) immediately. Since Keycloak sits in front of every connected app, a takeover cascades beyond the login page.