Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

The Hacker News 24 August 2026, 14:56 EEST Security Systems

Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as…

Read the full story on The Hacker News https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html

Attacks like this land on ordinary sites far more often than on chosen targets. If you would rather your site never became the story, CrockyHost hosting ships with daily backups, automatic updates and a firewall we manage.

Keep reading

South Korean startup platform breach exposes key management failures BleepingComputer
Microsoft: August updates break printing, PDF export in WPF apps BleepingComputer
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords The Hacker News
Shipping More AI Code Than You Can Secure? Watch How to Control Remediation Debt The Hacker News