CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

NCSC-2026-0326 [1.00] [M/H] Vulnerabilities patched in Keycloak

unknownpublic exploitCVE-2026-18963
Red Hat has patched multiple vulnerabilities in Keycloak. The vulnerability with CVE-2026-18963 can enable an unauthenticated external attacker to take over any user account by forcing a password reset. This vulnerability allows bypassing the email verification process during password reset and modifying user passwords. Additionally, vulnerabilities exist in Fine-Grained Admin Permissions (FGAP) v2, allowing certain administrators with limited permissions to view metadata of hidden groups and expose details of unauthorized parent groups. Furthermore, authenticated attackers can bypass CSRF protection via a legacy client-initiated account-linking endpoint and take over accounts. Delegated administrators with only read permissions can also read client secrets due to an error in secret rotation. For OpenTelemetry Java, a vulnerability existed where the lack of limits on baggage headers led to unbounded memory and CPU usage, which can cause Denial-of-Service. In Jackson libraries, a bypass of the @JsonIgnore annotation in Java Records was identified, allowing unwanted assignment to constructor parameters. There are also bypasses of @JsonIgnoreProperties, missing view guards on @JsonUnwrapped, and unauthorized write actions on fields with @JsonView. Oracle Database Server's Fleet Patching and Provisioning component is also affected by a vulnerability that can cause unauthorized data access or Denial-of-Service.

CSIRTS triage

vendor: Red Hatproduct: KeycloakAuthentication bypassPrivilege escalationInformation disclosureCross-site request forgery
What
Multiple vulnerabilities allow unauthenticated attackers to take over user accounts via password reset bypass, authenticated attackers to bypass CSRF protection and take over accounts, and administrators with limited permissions to view hidden group metadata and read client secrets.
Who is affected
All Keycloak deployments and users are affected; attackers can take over any user account.
Urgency
Critical; account takeover vulnerabilities are actively exploitable with no user interaction required.
Action
Apply Red Hat's Keycloak security patches immediately to all instances.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Keycloak

Get an email when a new Keycloak advisory drops — max one per day, one-click unsubscribe.

Details

Source
NCSC-NL Advisories (NL · national-cert · site)
Severity
unknown
Published
2026-08-25
Exploitation
Not in CISA KEV at last sync
Language
Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0326

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-18963coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Keycloak

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from NCSC-NL Advisories