Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as

The article reports that Red Hat and the Keycloak project patched a critical vulnerability (CVE-2026-18963) in the open-source Keycloak identity and access management server that allows an unauthenticated remote attacker to trigger password resets and take over any user account; Red Hat rated the flaw 9.1 on the CVSS scale. These are the only stated facts in the provided summary. From a RealGround perspective, compromise of an IAM platform like Keycloak can indirectly endanger AI systems that rely on it for authentication and authorization, enabling attackers to hijack AI admin or service accounts, alter configurations, or exfiltrate data. Organizations should treat IAM components as part of their AI supply chain, ensure timely patching, maintain a software bill of materials, and include such dependencies in AI security readiness and threat modeling.