Keycloak Fixes Critical CVE-2026-18963 Password Reset Flaw Allowing Unauthenticated Account Takeover
Keycloak has corrected a critical vulnerability, CVE-2026-18963, that allows a remote unauthenticated attacker to force a password reset for any user and take over the account. The priority is to update to the fixed versions or, if that is not possible, disable the Forgot password feature in all realms.
Keycloak, one of the most widely deployed products in corporate environments for identity and access management (IAM), has closed a critical vulnerability that opens the door to account takeover without authentication. The flaw, registered as CVE-2026-18963 and carrying a CVSS 3.1 score of 9.1, affects the reset-credentials flow and permits a remote attacker to complete a user password change without the usual email verification step.
The weakness stems from incorrect state validation inside the authentication flow. In practical terms, the system may accept a sequence of steps that should remain blocked until the user confirms the link sent by email. The result is a bypass: the attacker skips the verification phase and reaches the password change screen or endpoint directly, with the ability to set a new password and later access the account as the legitimate owner.
The most sensitive scenario occurs when the attacker targets administrative accounts. With that control, the attacker can modify policies, create users, assign roles, or alter configurations that affect applications integrated with Keycloak. The CVSS metric accurately reflects the risk: network attack vector, low complexity, no prior privileges, and no user interaction required. The impact focuses on confidentiality and integrity, while availability is not directly affected.
Upstream patches have been released in Keycloak 26.7.2 dated 19 August 2026. For Red Hat Build of Keycloak (RHBK), fixes are provided through updates in the 26.4 and 26.6 branches, specifically versions 26.4.15 and 26.6.6. As of 24 August 2026, Red Hat reports no known exploitation in the wild and no verified public exploit.
For organizations unable to apply updates immediately, the clearest mitigation is to disable the Forgot password recovery option. This setting must be applied realm by realm, so administrators should verify that the feature is disabled in every realm, especially in environments with multiple realms for subsidiaries, customers, or internal applications.
After applying the patch or mitigation, auditing remains essential. Reviewing login events and credential change logs for privileged accounts helps detect anomalous password resets and limits the scope if an attacker attempted to exploit the exposure window. In IAM systems, such a flaw can affect the entire connected ecosystem.
Related articles
Apple iOS Security Architecture: From Power Button to App Launch in Modern Devices
The article examines the complete boot and trust chain in modern iPhones, starting from the immutable BootROM and progressing through iBoot, the XNU kernel, and the Secure Enclave. It explains how Secure Boot verifies signatures but does not guarantee absence of vulnerabilities, allowing exploits like checkm8 to persist across devices. The piece details data protection classes, BFU versus AFU states, and how passcodes interact with hardware-bound keys to limit brute-force attempts. It further describes application sandboxing, entitlements, code signing, and Pointer Authentication (PAC) as layered defenses that raise the cost of exploitation. The analysis shows why modern jailbreaks require multi-stage chains involving kernel read/write, sandbox escapes, and PAC bypasses rather than single vulnerabilities. Overall, the architecture transforms privilege from a simple scalar into a graph of capabilities across isolated components.
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Enable Unauthenticated Remote Code Execution
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both scoring CVSS 9.2, were disclosed on October 21. The flaws allow attackers to execute arbitrary code without authentication by triggering out-of-memory conditions that lead to use-after-free memory corruption. Exploitation involves specially crafted requests that manipulate uninitialized arrays and function pointers, with full chains demonstrated via PHP_SESSION_UPLOAD_PROGRESS and fatal error backtraces. The issues affect PHP versions starting from 5.4 and were discovered using AI tools Gemini 4 Argon and GPT-5.6 Sol, resulting in a patch exceeding 10,000 lines of code. Amazon detected attacks as early as October 17, with Cloudflare later reporting millions of exploitation attempts. Mitigation requires updating to patched versions such as PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, while temporary workarounds include disabling session upload progress and fatal error backtraces.
Trend Micro ZDI Reports on Critical Linux KSMBD Vulnerabilities Leak to Public Mailing Lists Before Patches
Trend Micro Zero Day Initiative inadvertently published detailed vulnerability reports for the Linux kernel's KSMBD component into public mailing lists. Two flaws received CVSS scores of 9.0, enabling remote code execution under specific conditions. One issue involves a race condition during parallel SMB request handling, while the second stems from an incorrect buffer size calculation in the SMB Direct mechanism that requires RDMA and a writable share. Technical details including root causes and reproduction steps became publicly archived before fixes reached end users. The KSMBD maintainer has already merged a patch for ZDI-CAN-33774 into their repository, yet distribution kernels may still lack the update. Additional privilege-escalation and information-disclosure risks in other kernel components were also described in the leaked messages.
Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws
Node.js published security updates on October 21, 2026 for the 26.x, 24.x and 22.x release lines. The patches address multiple high-severity vulnerabilities affecting TLS hostname validation and the Brotli decoder, along with updates to critical dependencies including OpenSSL and Undici. Several CVEs cover bypasses in certificate hostname checks when IP addresses use full-width digits or when hosts resolve loosely to IP addresses. A particularly serious out-of-bounds write in the Brotli decoder (CVE-2026-111497) could enable remote code execution on services processing compressed responses. Additional fixes resolve keep-alive socket timing issues, DNS resolution truncation with NUL characters, and entropy caching problems in crypto.randomUUID and randomInt functions. The releases also update c-ares, Undici, OpenSSL, SQLite and ca-cert bundles following the eMudhra intermediate CA compromise.