How to Patch Keycloak Against CVE-2026-18963 in 6 Steps

If you run identity infrastructure, you need to know how to patch Keycloak against CVE-2026-18963 before anyone points it at your login page. This flaw, disclosed on August 24, 2026, carries a CVSS score of 9.1 and lets an unauthenticated attacker take over accounts through the password-reset flow. This guide gives you the exact steps.

Here is what happened. Researchers found that Keycloak’s reset-credentials flow performed improper state validation during email verification, so an attacker could bypass the check and seize control of an account without ever knowing the password. Red Hat published the advisory the same day. The affected versions are Keycloak 26.4.x below 26.4.15 and 26.6.x below 26.6.6. The fix ships in upstream 26.7.2, released August 19, 2026, and in Red Hat Build of Keycloak 26.4.15 and 26.6.6. There was no known exploitation in the wild as of August 24, but a 9.1 in an identity server is not something you wait on.

What You Need Before You Start

Get three things ready. First, know your exact Keycloak version and distribution, since the upstream project and Red Hat’s build use different version numbers. Check the admin console footer or run your container image tag against the release notes. Second, take a full backup of your Keycloak database and realm exports, because you never patch an authentication server without a rollback path. Third, line up a maintenance window and warn your teams, as a Keycloak restart briefly interrupts every single-sign-on session that depends on it. Confirm you have admin access to both the Keycloak host and the underlying database before you begin.

Step 1: Apply the Emergency Mitigation Now

If you cannot patch within the hour, buy yourself time by disabling the attack surface. Go into each realm and turn off the “Forgot password” feature under Realm Settings, then Login. This shuts down the reset-credentials flow the exploit depends on. It is inconvenient for legitimate users, but it closes the door immediately across every realm while you prepare the real fix. Treat this as a bridge, not a solution.

Step 2: Identify Every Affected Instance

Inventory every Keycloak deployment you run, including staging, internal tools, and that one forgotten instance behind a legacy app. Record each version. Anything on 26.4.x below 26.4.15 or 26.6.x below 26.6.6 is vulnerable. Do not assume a single production node is your whole footprint; identity servers have a habit of multiplying quietly across environments.

Step 3: Upgrade to a Fixed Release

Upgrade upstream Keycloak to 26.7.2, or Red Hat Build of Keycloak to 26.4.15 or 26.6.6, matching your current branch. For container deployments, update the image tag, pull the new image, and roll it out. For traditional installs, follow the standard Keycloak upgrade procedure: stop the server, replace the distribution, run the automatic database migration on first start, and confirm the version in the admin console. Staying on the same minor branch (26.4 to 26.4.15, for example) keeps the migration low-risk.

Step 4: Verify and Re-enable

Once patched, confirm the version, then re-enable “Forgot password” if you disabled it in Step 1. Test the reset-credentials flow end to end with a throwaway account. Check your logs for any suspicious reset attempts from before the patch, since a quiet 9.1 is still worth an audit. If you see signs of abuse, force a password reset for affected users and rotate any sessions or tokens issued during the exposure window.

Common Mistakes to Avoid

The first mistake is patching production and forgetting the three other instances nobody documented; attackers find the one you missed. The second is skipping the database backup because “it’s just a minor upgrade,” then having no way back when a migration surprises you. The third is treating the “Forgot password” toggle as the permanent fix and never actually upgrading, leaving the underlying flaw in place. Mitigation buys time; only the patched release removes the vulnerability.

Key Takeaways

  • Severity is real: CVE-2026-18963 is a CVSS 9.1 unauthenticated account takeover in an identity server.
  • Know your build: upstream fixes land in 26.7.2, Red Hat in 26.4.15 and 26.6.6.
  • Mitigate then patch: disable “Forgot password” first, upgrade second, never stop at the toggle.
  • Back up before you touch it: no authentication server gets patched without a rollback path.
  • Audit the window: check logs for reset abuse even though no exploitation was known at disclosure.

Need Expert Help?

If this feels like a lot to manage alone, TecniForge can handle the heavy lifting. Our team specializes in custom software development and AI integration, and we run identity and access management hardening for teams that cannot afford downtime. Get in touch with our experts.

Also read: Keycloak Vulnerability: 6 Urgent Steps to Patch CVE-2026-18963 Now — our earlier coverage on why this matters today.

Primary sources: the Red Hat CVE advisory, the Hacker News writeup, and the official Keycloak project release notes.

Patching an identity server is boring right up until the moment it is the only thing standing between an attacker and every account you own. Go check your versions now, not after your next meeting.