{"vulnerability": "CVE-2026-18963", "sightings": [{"uuid": "fee480be-76d4-4e18-a4e5-f04b99459afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/geFIdEurthJC81uvedAy7Je7bmf61756WHWGo7im76vrTZM", "content": "", "creation_timestamp": "2026-09-02T01:00:14.065636Z"}, {"uuid": "a6e6de0b-519e-4745-95f1-b3a0ead4e5ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/zg4wR79y8Xs5TR-sEF4ufViDE8nGerP6bqE6yl_hOH2_qzw", "content": "", "creation_timestamp": "2026-09-02T01:00:14.582938Z"}, {"uuid": "1c4a5e2a-f5bd-4987-ab54-a1d63706df12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mto3rjn35x2x", "content": "CVE-2026-18963 is trending. Hype score 5, currently #7 on cvemon.\n\nA flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-18963", "creation_timestamp": "2026-08-22T10:44:12.782476Z"}, {"uuid": "67986478-c1dd-4c74-9110-6a5f8c645891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/CCxoJ8x0-9sHy_OQ2iyfj3p9usknwtp1uIejR03vN46fXJs", "content": "", "creation_timestamp": "2026-08-21T05:00:04.280389Z"}, {"uuid": "8344a79d-8bb3-425d-b4b6-15873f468cf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mtj5mik5tt2f", "content": "\u26a0\ufe0f PATCH NOW\n\nKeycloak, the widely used single sign-on server, has a critical flaw (CVE-2026-18963) that lets a stranger reset any user's password and take over the account with no login.\n\nFix: update to 26.7.2 now.\n\nThe 26.4 and 26.6 support lines have no released patch yet.", "creation_timestamp": "2026-08-20T11:33:52.879179Z"}, {"uuid": "06c41b45-64c3-4919-89c1-e17d1f612c7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mtj5omzyis27", "content": "\ud83d\udea8 Dutch NCSC warns about CVE-2026-18963, a critical Keycloak password-reset vulnerability. \ud83d\udd10\n\nAffected systems may be exposed to unauthenticated account takeover.\n\nWhat to check and how to fix it:\nbasefortify.eu/posts/2026/0...\n\n#Keycloak #CyberSecurity", "creation_timestamp": "2026-08-20T11:35:09.318259Z"}, {"uuid": "053d44e9-f968-4687-8d49-b7df74885112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mtj5opfy5c27", "content": "\ud83d\udea8 Dutch NCSC warns about CVE-2026-18963, a critical Keycloak password-reset vulnerability. \ud83d\udd10\n\nAffected systems may be exposed to unauthenticated account takeover.\n\nWhat to check and how to fix it:\nbasefortify.eu/posts/2026/0...\n\n#Keycloak #CyberSecurity", "creation_timestamp": "2026-08-20T11:35:09.784406Z"}, {"uuid": "b6f24f74-788e-4613-bee5-9042ea08d05f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3mtj5oqdao227", "content": "\ud83d\udea8 Dutch NCSC warns about CVE-2026-18963, a critical Keycloak password-reset vulnerability. \ud83d\udd10\n\nAffected systems may be exposed to unauthenticated account takeover.\n\nWhat to check and how to fix it:\nbasefortify.eu/posts/2026/0...\n\n#Keycloak #CyberSecurity", "creation_timestamp": "2026-08-20T11:35:35.808323Z"}, {"uuid": "98ea40c0-bfb4-4b7c-8f8d-737d2e7ccfa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtestacb3z2u", "content": "\ud83d\udea8 CVE-2026-18963 \u2014 CVSS 9.1 CRITICAL\n\nA flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-18963\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T18:10:08.602372Z"}, {"uuid": "bfa9c3c4-27bf-4838-a495-618dd9b121b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/hacksilon.infosec.exchange.ap.brid.gy/post/3mth7jbccomz2", "content": "PSA: Critical account takeover vulnerability in #Keycloak - allows resetting arbitrary users\u2018 passwords. Update to 26.7.2 immediately or disable password reset. Tracked as CVE-2026-18963. https://github.com/keycloak/keycloak/issues/51833\n\n#infosec", "creation_timestamp": "2026-08-19T17:03:32.556725Z"}, {"uuid": "92df904e-70b1-4022-8cf1-75f653a0c133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtewqb76ms2c", "content": "CVE-2026-18963 - red hat build of keycloak\nAn attacker can reset any user's password without verification, gaining control over their account. This affects the identity and access management in Red Hat Build of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#redhat #CVE #infosec", "creation_timestamp": "2026-08-18T19:20:04.373523Z"}, {"uuid": "6a7b6c9d-1139-48ee-9a37-bde084a6fb35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtlghe3sun26", "content": "A Keycloak account takeover flaw, CVE-2026-18963, lets attackers reset any user's password with no email verification. Update to 26.7.2 now.\n\n#Keycloak #AccountTakeover #CVE #IAM #InfoSec #RedHat", "creation_timestamp": "2026-08-21T09:17:24.061349Z"}, {"uuid": "bd3b083b-f400-4bed-b033-0d4200ecff66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/CCxoJ8x0-9sHy_OQ2iyfj3p9usknwtp1uIejR03vN46fXJs", "content": "", "creation_timestamp": "2026-08-22T00:00:29.896802Z"}, {"uuid": "f980e84d-141a-4936-a389-8503477a2033", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html", "content": "Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.\n\nThe vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as", "creation_timestamp": "2026-08-24T13:00:34.129915Z"}, {"uuid": "0a7e788e-4f3a-45fb-9852-b44df57cd6aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mtw7pgsq6i2v", "content": "\ud83d\udce1 Keycloak Password Reset Bypass (CVE-2026-18963): Any Account, No Login Required", "creation_timestamp": "2026-08-25T16:15:55.437387Z"}, {"uuid": "bc657d6b-be1e-4a08-b2cc-2ad21ea86d37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/thehackernews/9875", "content": "\u203c\ufe0f A critical Keycloak flaw could let attackers take over any account.\n\nCVE-2026-18963 lets an unauthenticated attacker reset a user\u2019s password without the emailed action token, including for admin accounts.\n\nRead more: https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html", "creation_timestamp": "2026-08-24T14:00:03.989295Z"}, {"uuid": "f5257380-2598-45b2-9ceb-737796ad97e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18963", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mtthwu75qv2s", "content": "Keycloak CVE-2026-18963: unauthenticated password reset, any account, admins included.\nIf Keycloak is your SSO, identity is the perimeter. Patch now.\n#ThreatIntel #ICS #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/keycloak-cve-2026-18963-password-reset-account-takeover-2026", "creation_timestamp": "2026-08-24T14:05:15.514143Z"}, {"uuid": "8370e19f-9fd1-4f83-9ae5-e99f577cf6b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18963", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117150914311287522", "content": "\ud83d\udcf0 Critical Keycloak Flaw (CVE-2026-18963) Allows Account Takeover\n\ud83d\udea8 CRITICAL FLAW: Keycloak is vulnerable to CVE-2026-18963 (CVSS 9.1), allowing unauthenticated remote attackers to take over any account. Patches are available\u2014update immediately! #Keycloak #Cybersecurity #Vulnerability #CVE #IAM\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-keycloak-vulnerability-cve-2026-18963-allows-account-takeover/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-08-24T14:18:12.406261Z"}, {"uuid": "1b3f2bf6-e190-4afa-8511-685ba68e38cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mttioknme52l", "content": "\ud83d\udea8 CRITICAL FLAW: Keycloak is vulnerable to CVE-2026-18963 (CVSS 9.1), allowing unauthenticated remote attackers to take over any account. Patches are available\u2014update immediately! #Keycloak #Cybersecurity #Vulnerability #CVE #IAM\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-08-24T14:18:31.159289Z"}, {"uuid": "315a3e43-1c45-489a-b936-8559c3be2424", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mtzfklhx6k2h", "content": "Wednesday's fuck up - this time KeyCloak - github.com/snizi/cve-20...\n\nCVE-2026-18963 \u2014 Keycloak reset-credentials bypass \u2192 unauthenticated account takeover\n\n#github #poc #keycloak #exploit #cve-2026-189623 #critical #auth #bypass #redteam", "creation_timestamp": "2026-08-26T12:38:59.262813Z"}, {"uuid": "eddd08bf-8502-4f8d-8777-22d3ac0771d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mttjqkfgcu2t", "content": "Keycloak CVE-2026-18963 could let unauthenticated attackers skip the emailed action token and reset any user's password.", "creation_timestamp": "2026-08-24T14:37:31.503406Z"}, {"uuid": "4cf8ba7c-42d6-45fa-8785-400e44b3d2cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99500", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a T0w0T\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-24 13:12:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T15:00:04.800248Z"}, {"uuid": "ca5dd14f-8326-4ddb-84bc-241523fe7840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-27T12:00:09.826180Z"}, {"uuid": "3505a250-af83-4d5f-bc61-39f0feaca326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mttow6gn3727", "content": "CVE-2026-18963: Keycloak Account Takeover in Seconds, Bypassing MFA", "creation_timestamp": "2026-08-24T16:10:09.393246Z"}, {"uuid": "da65ec14-7514-47f7-8226-54a6bf206dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://www.cert.se/2026/08/cert-se-veckobrev-v35.html", "content": "", "creation_timestamp": "2026-08-28T12:45:08.168370Z"}, {"uuid": "951ab511-5965-4c51-8c95-be7e3b29374d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac24fb5c-fbc7-4c87-9137-bb60608b01e0", "content": "", "creation_timestamp": "2026-08-26T16:00:25.891005Z"}, {"uuid": "83054378-519d-4561-b41b-2f58c8b031cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/GithubRedTeam/98983", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18963-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Snizi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-20 22:01:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for KeyCloak CVE-2026-18963\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:05.086837Z"}, {"uuid": "936880ca-7e29-492b-9640-8a9af8084388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/ransomnews.online/post/3mtttrlmphy2x", "content": "\u26a0\ufe0f Critical Keycloak flaw enables account takeover\n\nCVE-2026-18963 lets unauthenticated attackers reset any user's password, bypassing email verification.\n\n\ud83d\udd17 read more: thehackernews.com/20...\n\n#ransomNews #cyberthreats #Keycloak", "creation_timestamp": "2026-08-24T17:37:03.831880Z"}, {"uuid": "2323351f-477d-4a9f-a85d-9dd58b6cad95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/captainsmok3r_official/468", "content": "CVE-2026-18963 \u2014 Keycloak Forgot-Password Flow Authentication Bypass-  PoC\nsource-> https://github.com/T0w0T/POC-CVE-2026-18963", "creation_timestamp": "2026-08-24T18:00:03.494278Z"}, {"uuid": "dc85e32c-1f00-4f2d-9f83-8fbb6a8b63ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/GithubRedTeam/99674", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a debugactiveprocess\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 16:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclei template to discover Keycloak reset-credentials endpoints related to CVE-2026-18963 exposure validation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T19:00:03.615583Z"}, {"uuid": "507f7d66-6f8c-4cc6-8065-f39a9b0ae8c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/GithubRedTeam/99591", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Keycloak_CVE-2026-18963_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a prot0tw\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 8  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 04:59:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T19:00:03.667540Z"}, {"uuid": "b395031a-06b0-4b34-95d7-eef0d5d4ad01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/GithubRedTeam/99597", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Exploit-For-CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BlackHatExploitation\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 05:53:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-18963 by BlackHatExploitation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T19:00:03.717416Z"}, {"uuid": "009311bf-02b4-43ac-863b-7b0132f4dd8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/GithubRedTeam/99662", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a keycloak-CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gman0x00\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 15:27:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC, Dockerfile playground and root cause from patch diff analysis.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T19:00:03.922764Z"}, {"uuid": "24211bf0-f2d4-40cd-ad68-805ce3aff96f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18963", "type": "seen", "source": "https://gist.github.com/asifnawazminhas/ef499fdd55a5bf49b5056c3e3a7eddbb", "content": "#!/usr/bin/env python3\n\"\"\"Hunt CVE-2026-18963-style password resets via the Keycloak Admin Events API.\n\nCVE-2026-18963 is a reset-credentials flow bypass in Keycloak 26.0.0 through\n26.7.1 (fixed in 26.7.2, 26.4.15, and 26.6.6). An attacker who knows a username\ncan reach UPDATE_PASSWORD without clicking the email action-token link.\nSee https://access.redhat.com/security/cve/cve-2026-18963 , issue #51833,\nand fix PR #51844.\n\nFingerprint: SEND_RESET_PASSWORD or SEND_RESET_PASSWORD_ERROR, then\nUPDATE_PASSWORD or UPDATE_CREDENTIAL (password) on the same code_id, with\ndelta <= --threshold-ms (default 5000). EXECUTE_ACTION_TOKEN is not a reliable\nsuccess signal for this path. This is a heuristic, not proof of exploit: a\nlegitimate reset completed very quickly can also match.\n\nRequires Direct Access Grants on the OIDC client (admin-cli by default) and\nrealm-management/view-events. If listing realms is forbidden, only\n--auth-realm is scanned.\n\nExamples:\n  python3 cve-2026-18963-hunt.py --base https://keycloak.example --admin alice --since 7d --skip-master\n  python3 cve-2026-18963-hunt.py --base https://keycloak.example --auth-realm myrealm --admin alice --realm myrealm --since 24h\n\nEnvironment: KC_BASE, KC_AUTH_REALM, KC_CLIENT, KC_CLIENT_SECRET, KC_ADMIN,\nKC_ADMIN_PASS, KC_TOTP, KC_SINCE, THRESHOLD_MS.\n\nExit codes: 0 no pair under threshold, 1 at least one SUSPECT, 2 login failure.\n\"\"\"\nfrom __future__ import annotations\n\nimport argparse\nimport datetime as dt\nimport getpass\nimport json\nimport os\nimport sys\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nfrom typing import Any, Dict, Iterable, List, Optional, Tuple\n\nSEND_TYPES = (\"SEND_RESET_PASSWORD\", \"SEND_RESET_PASSWORD_ERROR\")\nUPDATE_TYPES = (\"UPDATE_PASSWORD\", \"UPDATE_CREDENTIAL\")\nPAGE = 100\n\n\nCOLOR_LOG = sys.stderr.isatty()\n\n\ndef log(msg: str) -> None:\n    ts = dt.datetime.now().strftime(\"%H:%M:%S\")\n    prefix = f\"[{ts}]\"\n    if COLOR_LOG:\n        prefix = f\"\\033[2m{prefix}\\033[0m\"\n    sys.stderr.write(f\"{prefix} {msg}\\n\")\n    sys.stderr.flush()\n\n\ndef parse_since(value: str) -> int:\n    \"\"\"Return epoch milliseconds. Accepts 90m / 24h / 7d / ISO-8601 / epoch-ms.\"\"\"\n    raw = value.strip()\n    now = time.time()\n    if raw.isdigit():\n        n = int(raw)\n        return n if n > 10_000_000_000 else int(n * 1000)\n    unit = raw[-1].lower()\n    if unit in \"smhd\" and raw[:-1].replace(\".\", \"\", 1).isdigit():\n        qty = float(raw[:-1])\n        mult = {\"s\": 1, \"m\": 60, \"h\": 3600, \"d\": 86400}[unit]\n        return int((now - qty * mult) * 1000)\n    iso = raw.replace(\"Z\", \"+00:00\")\n    parsed = dt.datetime.fromisoformat(iso)\n    if parsed.tzinfo is None:\n        parsed = parsed.replace(tzinfo=dt.timezone.utc)\n    return int(parsed.timestamp() * 1000)\n\n\ndef iso_utc(ms: int) -> str:\n    return dt.datetime.fromtimestamp(ms / 1000, dt.timezone.utc).strftime(\"%Y-%m-%d %H:%M:%S UTC\")\n\n\ndef http_json(\n    method: str,\n    url: str,\n    *,\n    token: Optional[str] = None,\n    form: Optional[Dict[str, str]] = None,\n    timeout: int = 60,\n) -> Tuple[int, Any]:\n    data = None\n    headers = {\"Accept\": \"application/json\"}\n    if form is not None:\n        data = urllib.parse.urlencode(form).encode()\n        headers[\"Content-Type\"] = \"application/x-www-form-urlencoded\"\n    if token:\n        headers[\"Authorization\"] = f\"Bearer {token}\"\n    req = urllib.request.Request(url, data=data, headers=headers, method=method)\n    try:\n        with urllib.request.urlopen(req, timeout=timeout) as resp:\n            body = resp.read().decode(\"utf-8\", errors=\"replace\")\n            return resp.status, json.loads(body) if body else None\n    except urllib.error.HTTPError as e:\n        body = e.read().decode(\"utf-8\", errors=\"replace\")\n        try:\n            parsed = json.loads(body) if body else {}\n        except json.JSONDecodeError:\n            parsed = {\"error\": body}\n        return e.code, parsed\n\n\ndef login(\n    base: str,\n    auth_realm: str,\n    user: str,\n    password: str,\n    totp: Optional[str],\n    client_id: str,\n    client_secret: Optional[str],\n) -> str:\n    form = {\n        \"client_id\": client_id,\n        \"username\": user,\n        \"password\": password,\n        \"grant_type\": \"password\",\n    }\n    if totp:\n        form[\"totp\"] = totp\n    if client_secret:\n        form[\"client_secret\"] = client_secret\n    url = f\"{base}/realms/{urllib.parse.quote(auth_realm)}/protocol/openid-connect/token\"\n    status, body = http_json(\"POST\", url, form=form)\n    if status == 200 and isinstance(body, dict) and body.get(\"access_token\"):\n        return str(body[\"access_token\"])\n    desc = \"\"\n    if isinstance(body, dict):\n        desc = str(body.get(\"error_description\") or body.get(\"error\") or body)\n    raise RuntimeError(f\"Admin login failed on realm {auth_realm} (HTTP {status}): {desc}\")\n\n\ndef needs_otp(exc: RuntimeError) -> bool:\n    msg = str(exc).lower()\n    return any(k in msg for k in (\"otp\", \"totp\", \"mfa\", \"invalid user credentials\", \"invalid_grant\"))\n\n\ndef fetch_events(base: str, token: str, realm: str, event_type: str, date_from_ms: Optional[int], cap: int) -> List[dict]:\n    out: List[dict] = []\n    first = 0\n    while first < cap:\n        q = {\n            \"type\": event_type,\n            \"first\": str(first),\n            \"max\": str(min(PAGE, cap - first)),\n        }\n        if date_from_ms is not None:\n            q[\"dateFrom\"] = str(date_from_ms)\n        url = f\"{base}/admin/realms/{urllib.parse.quote(realm)}/events?{urllib.parse.urlencode(q)}\"\n        status, body = http_json(\"GET\", url, token=token)\n        if status == 403:\n            log(f\"  skip {realm}/{event_type}: HTTP 403 (no view-events?)\")\n            return []\n        if status != 200 or not isinstance(body, list):\n            log(f\"  skip {realm}/{event_type}: HTTP {status} {body}\")\n            return []\n        out.extend(body)\n        if len(body) < PAGE:\n            break\n        first += PAGE\n    return out\n\n\ndef is_password_update(event: dict) -> bool:\n    if event.get(\"type\") == \"UPDATE_PASSWORD\":\n        return True\n    details = event.get(\"details\") or {}\n    return details.get(\"credential_type\") == \"password\" or details.get(\"custom_required_action\") == \"UPDATE_PASSWORD\"\n\n\ndef code_id(event: dict) -> str:\n    return str((event.get(\"details\") or {}).get(\"code_id\") or \"\")\n\n\ndef username(event: dict) -> str:\n    return str((event.get(\"details\") or {}).get(\"username\") or event.get(\"userId\") or \"?\")\n\n\ndef ts(event: dict) -> int:\n    return int(event.get(\"time\") or 0)\n\n\ndef pairs_for_realm(sends: Iterable[dict], updates: Iterable[dict], threshold_ms: int) -> List[dict]:\n    by_code: Dict[str, List[dict]] = {}\n    for e in sends:\n        cid = code_id(e)\n        if cid:\n            by_code.setdefault(cid, []).append(e)\n\n    rows = []\n    seen = set()\n    for u in sorted(updates, key=ts):\n        cid = code_id(u)\n        if not cid or cid in seen:\n            continue\n        cands = [s for s in by_code.get(cid, []) if ts(s) <= ts(u)]\n        if not cands:\n            continue\n        send = max(cands, key=ts)\n        delta = ts(u) - ts(send)\n        seen.add(cid)\n        rows.append(\n            {\n                \"delta_ms\": delta,\n                \"suspect\": delta <= threshold_ms,\n                \"username\": username(u),\n                \"send\": send.get(\"type\"),\n                \"update_utc\": iso_utc(ts(u)),\n                \"code_id\": cid,\n                \"user_id\": u.get(\"userId\") or \"\",\n            }\n        )\n    return rows\n\n\ndef term_width() -> int:\n    try:\n        return max(80, os.get_terminal_size().columns)\n    except OSError:\n        return 120\n\n\ndef paint(text: str, color: str, enabled: bool) -> str:\n    if not enabled:\n        return text\n    codes = {\"red\": \"31\", \"green\": \"32\", \"yellow\": \"33\", \"bold\": \"1\", \"dim\": \"2\"}\n    return f\"\\033[{codes[color]}m{text}\\033[0m\"\n\n\ndef print_table(rows: List[dict], color: bool) -> None:\n    if not rows:\n        print(\"  (no send->update pair on the same code_id)\")\n        return\n    headers = [\"delta_ms\", \"verdict\", \"username\", \"send\", \"update (UTC)\", \"code_id\"]\n    cells = []\n    for r in rows:\n        verdict = \"SUSPECT\" if r[\"suspect\"] else \"ok\"\n        cells.append(\n            [\n                str(r[\"delta_ms\"]),\n                verdict,\n                r[\"username\"],\n                str(r[\"send\"]),\n                r[\"update_utc\"],\n                r[\"code_id\"],\n            ]\n        )\n    widths = [len(h) for h in headers]\n    for row in cells:\n        for i, cell in enumerate(row):\n            widths[i] = max(widths[i], len(cell))\n    budget = term_width() - 4 - 3 * (len(headers) - 1)\n    extra = sum(widths) - budget\n    if extra > 0:\n        widths[-1] = max(12, widths[-1] - extra)\n\n    def fmt_row(cols: List[str], *, header: bool = False, suspect: bool = False) -> str:\n        padded = []\n        for i, col in enumerate(cols):\n            val = col if len(col) <= widths[i] else col[: max(0, widths[i] - 3)] + \"...\"\n            padded.append(val.ljust(widths[i]) if i else val.rjust(widths[i]))\n        line = \"  \" + \"   \".join(padded)\n        if header:\n            return paint(line, \"bold\", color)\n        if suspect:\n            return paint(line, \"red\", color)\n        return line\n\n    print(fmt_row(headers, header=True))\n    print(\"  \" + paint(\"-\" * min(term_width() - 2, sum(widths) + 3 * (len(headers) - 1)), \"dim\", color))\n    for r, cols in zip(rows, cells):\n        print(fmt_row(cols, suspect=r[\"suspect\"]))\n\n\ndef main() -> int:\n    p = argparse.ArgumentParser(\n        formatter_class=argparse.RawDescriptionHelpFormatter,\n        description=__doc__,\n    )\n    p.add_argument(\n        \"--base\",\n        default=os.environ.get(\"KC_BASE\"),\n        required=not os.environ.get(\"KC_BASE\"),\n        help=\"Keycloak base URL (or $KC_BASE)\",\n    )\n    p.add_argument(\"--realm\", action=\"append\", dest=\"realms\", help=\"Realm to scan (repeatable). Default: all, or auth-realm if listing fails\")\n    p.add_argument(\"--auth-realm\", default=os.environ.get(\"KC_AUTH_REALM\", \"master\"), help=\"Realm used for the password grant (default: master)\")\n    p.add_argument(\"--client\", default=os.environ.get(\"KC_CLIENT\", \"admin-cli\"), help=\"Client id for password grant (default: admin-cli)\")\n    p.add_argument(\"--client-secret\", default=os.environ.get(\"KC_CLIENT_SECRET\"), help=\"Client secret if the client is confidential\")\n    p.add_argument(\"--skip-master\", action=\"store_true\", help=\"Skip master when scanning all realms\")\n    p.add_argument(\n        \"--admin\",\n        default=os.environ.get(\"KC_ADMIN\"),\n        help=\"Admin username for the password grant (or $KC_ADMIN). Prompted if missing\",\n    )\n    p.add_argument(\"--admin-pass\", default=os.environ.get(\"KC_ADMIN_PASS\"))\n    p.add_argument(\"--totp\", default=os.environ.get(\"KC_TOTP\"), help=\"OTP code (or $KC_TOTP). Prompted if login requires it\")\n    p.add_argument(\"--since\", default=os.environ.get(\"KC_SINCE\", \"7d\"), help=\"Window: 90m, 24h, 7d, or ISO-8601 (default: 7d)\")\n    p.add_argument(\"--since-hours\", type=float, help=\"Deprecated alias of --since Nh\")\n    p.add_argument(\"--threshold-ms\", type=int, default=int(os.environ.get(\"THRESHOLD_MS\", \"5000\")))\n    p.add_argument(\"--max\", type=int, default=5000, dest=\"cap\", help=\"Max events per type per realm\")\n    p.add_argument(\"--no-color\", action=\"store_true\")\n    args = p.parse_args()\n\n    color = sys.stdout.isatty() and not args.no_color\n    global COLOR_LOG\n    COLOR_LOG = sys.stderr.isatty() and not args.no_color\n    base = args.base.rstrip(\"/\")\n    since = f\"{args.since_hours}h\" if args.since_hours is not None else args.since\n    date_from = parse_since(since)\n    admin = args.admin or input(\"Admin username: \").strip()\n    if not admin:\n        log(\"admin username required\")\n        return 2\n    password = args.admin_pass or getpass.getpass(f\"Password for {admin}: \")\n    totp = args.totp\n\n    log(f\"login {args.client} as {admin} on realm {args.auth_realm} ({base})\")\n    try:\n        token = login(base, args.auth_realm, admin, password, totp, args.client, args.client_secret)\n    except RuntimeError as e:\n        if totp or not needs_otp(e):\n            log(str(e))\n            return 2\n        totp = getpass.getpass(\"OTP: \")\n        log(\"retry login with OTP\")\n        try:\n            token = login(base, args.auth_realm, admin, password, totp, args.client, args.client_secret)\n        except RuntimeError as e2:\n            log(str(e2))\n            return 2\n    log(\"token OK\")\n\n    if args.realms:\n        realms = args.realms\n    else:\n        status, body = http_json(\"GET\", f\"{base}/admin/realms\", token=token)\n        if status == 200 and isinstance(body, list):\n            realms = [str(r.get(\"realm\")) for r in body if r.get(\"realm\")]\n            if args.skip_master:\n                realms = [r for r in realms if r != \"master\"]\n            log(f\"{len(realms)} realm(s): {', '.join(realms)}\")\n        else:\n            log(f\"cannot list all realms (HTTP {status}); scan auth-realm only: {args.auth_realm}\")\n            realms = [args.auth_realm]\n\n    print()\n    print(paint(\"CVE-2026-18963 reset timing hunt\", \"bold\", color))\n    print(f\"  instance   {base}\")\n    print(f\"  auth-realm {args.auth_realm}  client={args.client}\")\n    print(f\"  since      {iso_utc(date_from)}  ({since})\")\n    print(f\"  threshold  {args.threshold_ms} ms\")\n    print()\n\n    all_rows: List[Tuple[str, dict]] = []\n    for realm in realms:\n        log(f\"scan realm {realm}\")\n        sends: List[dict] = []\n        for t in SEND_TYPES:\n            sends.extend(fetch_events(base, token, realm, t, date_from, args.cap))\n        updates: List[dict] = []\n        for t in UPDATE_TYPES:\n            updates.extend(e for e in fetch_events(base, token, realm, t, date_from, args.cap) if is_password_update(e))\n        rows = pairs_for_realm(sends, updates, args.threshold_ms)\n        suspects = sum(1 for r in rows if r[\"suspect\"])\n        log(f\"  {realm}: sends={len(sends)} updates={len(updates)} pairs={len(rows)} suspect={suspects}\")\n        print(paint(f\"> {realm}\", \"bold\", color) + paint(f\"   {len(sends)} send | {len(updates)} update | {len(rows)} pair\", \"dim\", color))\n        print_table(rows, color)\n        print()\n        for r in rows:\n            all_rows.append((realm, r))\n\n    suspects = [(realm, r) for realm, r in all_rows if r[\"suspect\"]]\n    print(paint(\"summary\", \"bold\", color))\n    print(f\"  realms={len(realms)}  pairs={len(all_rows)}  suspect={len(suspects)}\")\n    if suspects:\n        print(paint(\"  -> review SUSPECT rows (send then password change on same code_id).\", \"yellow\", color))\n        return 1\n    print(paint(\"  -> no pair under threshold.\", \"green\", color))\n    return 0\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())", "creation_timestamp": "2026-08-24T18:16:44.821002Z"}, {"uuid": "7c8d37b9-9e8a-4266-93fc-1ed9710c2407", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98983", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18963-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Snizi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-20 22:01:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for KeyCloak CVE-2026-18963\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:31.291393Z"}, {"uuid": "96d02051-5898-46ce-8b67-b1ea4e157a97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/nONnDQ4DyQPKEexYtY3Ij8D3IFHqfw5qjdooYpYKDB0Z_ok", "content": "", "creation_timestamp": "2026-08-24T21:00:04.131083Z"}, {"uuid": "5c8f6298-1bd6-4f86-894d-db015517eb40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/6ZXK7POZZlImrj5dLLibRYEQ7wtBboBltu7VV8uaBcnQlQ", "content": "", "creation_timestamp": "2026-08-24T23:00:04.539015Z"}, {"uuid": "a95e7cb4-305f-41bc-b696-aa695b4fbb60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-28T00:00:52.513194Z"}, {"uuid": "c3c00428-e21c-46a6-859a-ef4e37c0ea5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-18963.yaml", "content": "", "creation_timestamp": "2026-08-25T00:00:04.182022Z"}, {"uuid": "2d05a844-9c12-4104-a01f-29a8860d2aed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/6ZXK7POZZlImrj5dLLibRYEQ7wtBboBltu7VV8uaBcnQlQ", "content": "", "creation_timestamp": "2026-08-25T00:00:04.999370Z"}, {"uuid": "12117540-1d74-4e56-88a0-8b6d8b0a6a94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/nONnDQ4DyQPKEexYtY3Ij8D3IFHqfw5qjdooYpYKDB0Z_ok", "content": "", "creation_timestamp": "2026-08-25T00:00:09.766055Z"}, {"uuid": "cd4a2bd9-1519-4c4a-8962-84392ff56983", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/468", "content": "CVE-2026-18963 \u2014 Keycloak Forgot-Password Flow Authentication Bypass-  PoC\nsource-> https://github.com/T0w0T/POC-CVE-2026-18963", "creation_timestamp": "2026-08-25T00:00:11.620705Z"}, {"uuid": "1f08c68c-41b7-4116-a178-a7471f28bc72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99500", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a T0w0T\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-24 13:12:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-25T00:00:23.289593Z"}, {"uuid": "0b486fb9-8285-4b21-ad41-04099587cf92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/thehackernews/9875", "content": "\u203c\ufe0f A critical Keycloak flaw could let attackers take over any account.\n\nCVE-2026-18963 lets an unauthenticated attacker reset a user\u2019s password without the emailed action token, including for admin accounts.\n\nRead more: https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html", "creation_timestamp": "2026-08-25T00:00:23.899111Z"}, {"uuid": "c0fcc38d-06ac-4700-a21e-ac8447d35349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-18963.yaml", "content": "", "creation_timestamp": "2026-08-26T00:00:03.754704Z"}, {"uuid": "907d24c1-ee48-4327-9ebe-a2f71a3cf183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99597", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Exploit-For-CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BlackHatExploitation\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 05:53:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-18963 by BlackHatExploitation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T00:00:09.499449Z"}, {"uuid": "440be721-0f4d-4b09-84af-bdcfdc89fe9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99591", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Keycloak_CVE-2026-18963_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a prot0tw\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 8  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 04:59:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T00:00:09.552030Z"}, {"uuid": "0a0fe050-430c-45ae-9303-ae7a0506667d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99674", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a debugactiveprocess\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 16:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclei template to discover Keycloak reset-credentials endpoints related to CVE-2026-18963 exposure validation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T00:00:09.608215Z"}, {"uuid": "7e7afc46-971d-4a0c-88d4-0791f29ae003", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/pphm_HackerNews/2827", "content": "\ud83d\udd34 Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account\n\nRed Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.\n\nThe vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as the CVE Numbering Authority (CNA) for the flaw. It has been classified as a weak password recovery mechanism for a forgotten password (CWE-640).", "creation_timestamp": "2026-08-25T01:00:04.007754Z"}, {"uuid": "995b1476-0290-4269-af2f-a91044d09320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/Ks6sPRK7rGEZMA3UBlp7GLmJzLFcjQs_KZ-4Nh0Q9BWMtB8", "content": "", "creation_timestamp": "2026-08-26T00:00:22.718268Z"}, {"uuid": "49af0a15-8926-42e5-8f81-f7762dfb0616", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/NQ4f64ohdrG1pVyyV_gFDkG0-xGkTrwnbEfbjo2AiahMr30", "content": "", "creation_timestamp": "2026-08-26T00:00:22.756538Z"}, {"uuid": "086826f5-e397-48c5-b16b-0540d8c3345a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/pphm_HackerNews/2827", "content": "\ud83d\udd34 Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account\n\nRed Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.\n\nThe vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as the CVE Numbering Authority (CNA) for the flaw. It has been classified as a weak password recovery mechanism for a forgotten password (CWE-640).", "creation_timestamp": "2026-08-26T00:00:22.818483Z"}, {"uuid": "350f1123-a600-4e88-b3c2-388db4eb862c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html", "content": "Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset.\n\nThe vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as", "creation_timestamp": "2026-08-25T01:00:35.162326Z"}, {"uuid": "4eaadeda-49ea-4c15-970b-b2100df2b58f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99662", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a keycloak-CVE-2026-18963\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gman0x00\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-25 15:27:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC, Dockerfile playground and root cause from patch diff analysis.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-26T00:00:09.298787Z"}, {"uuid": "e67ac71a-78e8-4236-b37b-458e57deac3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/477", "content": "CVE-2026-18963 Keycloak reset-credentials bypass \u2192 unauthenticated account takeover\u00a0CVSS 9.1\u00a0| Affected: Keycloak 26.0.0 \u2013 26.7.1\npoc: https://github.com/prot0tw/Keycloak_CVE-2026-18963_PoC", "creation_timestamp": "2026-08-26T00:00:10.464933Z"}, {"uuid": "f169df01-6a5b-47ef-88c3-715c7af4bad2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99885", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18963_analyst\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a minh3102011\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-27 02:45:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-28T00:01:01.825603Z"}, {"uuid": "42f1334b-ffbc-4e2f-9f55-78963cc3f0ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0326", "content": "Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak. De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen. Door deze kwetsbaarheid valt het e-mailverificatieproces bij wachtwoordreset te omzeilen en wachtwoorden van gebruikers te wijzigen.\n\nIn Keycloak zijn daarnaast kwetsbaarheden aanwezig in de Fine-Grained Admin Permissions (FGAP) v2, waardoor bepaalde beheerders met beperkte permissies metadata van verborgen groepen kunnen inzien en details van ongeautoriseerde oudergroepen kunnen blootstellen. Verder kunnen geauthenticeerde aanvallers via een legacy client-initiated account-linking endpoint CSRF-bescherming omzeilen en accounts overnemen. Ook kunnen gedelegeerde beheerders met alleen leesrechten client secrets uitlezen door een fout in de secret rotation. Voor OpenTelemetry Java was er een kwetsbaarheid waarbij het ontbreken van limieten op baggage headers leidde tot onbegrensd geheugen- en CPU-gebruik, wat Denial-of-Service kan veroorzaken. Bij Jackson-libraries is een bypass van de @JsonIgnore annotatie in Java Records vastgesteld, waardoor ongewenste toewijzing aan constructorparameters mogelijk is. Ook zijn er bypasses van @JsonIgnoreProperties, ontbrekende view guards op @JsonUnwrapped en ongeautoriseerde schrijfacties op velden met @JsonView. Oracle Database Server's Fleet Patching and Provisioning component is eveneens getroffen door een kwetsbaarheid die ongeautoriseerde data toegang of Denial-of-Service kan veroorzaken.", "creation_timestamp": "2026-08-26T01:00:35.222940Z"}, {"uuid": "1b444b23-a241-4415-8993-8bcc641dd942", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mtusc5aguv2l", "content": "Top 3 CVE for last 7 days:\nCVE-2026-69836: 43 interactions\nCVE-2026-73570: 21 interactions\nCVE-2026-19478: 18 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-73570: 15 interactions\nCVE-2026-77995: 6 interactions\nCVE-2026-18963: 4 interactions\n", "creation_timestamp": "2026-08-25T02:43:10.885489Z"}, {"uuid": "cd26b898-189d-408a-b461-d439e80ae64c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mtuwvpfj7a2q", "content": "VULN ALERT: Keycloak CVE-2026-18963 \u2014 critical password reset flaw (9.1 CVSS) allows unauthenticated remote attackers to take over any user account. Patched in 26.7.2. Turn off \"Forgot password\" if unpatched. #InfoSec #ThreatIntel", "creation_timestamp": "2026-08-25T04:05:42.389692Z"}, {"uuid": "33bfd7d6-cd4e-454f-83ae-b8cad0833225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-18963.yaml", "content": "", "creation_timestamp": "2026-08-27T00:00:04.619778Z"}, {"uuid": "ed8350e1-77f2-443f-81c9-19d6ee755d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/NQ4f64ohdrG1pVyyV_gFDkG0-xGkTrwnbEfbjo2AiahMr30", "content": "", "creation_timestamp": "2026-08-25T05:00:03.402953Z"}, {"uuid": "cea8e4ab-574b-4977-81f0-8ac8690c0ccd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mtxd5v3mwz2l", "content": "Top 3 CVE for last 7 days:\nCVE-2026-69836: 43 interactions\nCVE-2026-73570: 22 interactions\nCVE-2026-19490: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-18963: 9 interactions\nCVE-2026-55040: 6 interactions\nCVE-2026-63520: 6 interactions\n", "creation_timestamp": "2026-08-26T02:50:21.280650Z"}, {"uuid": "931fa0ca-11b3-45ee-b82b-f1d454b2aa87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mtv2zvhd372d", "content": "\u300c\u30d1\u30b9\u30ef\u30fc\u30c9\u5fd8\u308c\u300d\u306e\u30e1\u30fc\u30eb\u3092\u30af\u30ea\u30c3\u30af\u3055\u305b\u306d\u3047\u3067\u3001\u4efb\u610f\u30e6\u30fc\u30b6\u30fc\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u66f8\u304d\u63db\u3048\u3089\u308c\u308b\u3002Keycloak\u306ereset-credentials\u3001\u72b6\u614b\u691c\u8a3c\u304c\u629c\u3051\u3066\u305f\u3002\ud83d\udc8e\nCVE-2026-18963\u3001CVSS 9.1\u3002\u672a\u8a8d\u8a3c\u30fbUI\u4e0d\u8981\u3002\u7ba1\u7406\u8005\u30a2\u30ab\u30a6\u30f3\u30c8\u3082\u5bfe\u8c61\u3002\nhttps://access.redhat.com/security/cve/CVE-2026-18963\n#Keycloak #CVE #AuthN", "creation_timestamp": "2026-08-25T05:19:38.287388Z"}, {"uuid": "26fa9521-5f78-45c9-9050-7f2f34b7bab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mtv2zw5k2c2v", "content": "IdP\u306f\u4e00\u7b87\u6240\u629c\u3051\u308b\u3068\u3001\u5f8c\u308d\u306b\u7e4b\u304c\u3063\u3066\u308b\u5168\u90e8\u304c\u9053\u9023\u308c\u3060\u3002\u6d3e\u624b\u306aRCE\u3088\u308a\u5730\u5473\u306b\u898b\u3048\u308b\u304c\u3001\u6a29\u9650\u306e\u6839\u3092\u633f\u3052\u66ff\u3048\u308b\u7a74\u3060\u305c\u3002\n\n\u4fee\u6b63\u306f upstream 26.7.2\u3001RHBK 26.4.15 / 26.6.6\u3002\u3059\u3050\u4e0a\u3052\u3089\u308c\u306d\u3047\u306a\u3089\u3001\u5168realm\u3067 Forgot password \u3092\u5207\u308c\u3002\ud83d\udc8e\n\u60aa\u7528\u78ba\u8a8d\u306f\u4eca\u306e\u3068\u3053\u308d\u7121\u3044\u3001\u3063\u3066\u8a71\u3060\u3002\ud83d\udd4a\ufe0f \u3067\u3082\u7a74\u306f\u958b\u3044\u3066\u308b\u3002\u9375\u306e\u7f6e\u304d\u5834\u3092\u7591\u3048\u3002\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18963\nhttps://x.com/DailyDarkWeb/status/2092082742833852451\n#IAM #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-08-25T05:19:38.838431Z"}, {"uuid": "1667f6d2-2758-438e-b2b4-7c506844a364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18963", "type": "seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mtxhzyxgel2v", "content": "CVE-2026-18963: Keycloak Reset-Credentials Bypass Enables Full Account Takeover\n\nhttps://blindthoughts.com/keycloak-cve-2026-18963-reset-credentials-bypass-account-takeover\n\n#keycloak #cve #authentication #accounttakeover #identity", "creation_timestamp": "2026-08-26T04:17:39.706106Z"}, {"uuid": "4ff47c49-f148-45f3-84a7-505616224383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/jarkafterdark.com/post/3mu7hidemfa2q", "content": "CVE-2026-18963, rated 9.1. the reset-credentials flow trusts a verification step it never actually checks. over 111,000 keycloak instances are exposed to the internet right now.\n\ndetails at the hacker news: thehackernews.com/2026/08/crit...", "creation_timestamp": "2026-08-29T08:29:04.442246Z"}, {"uuid": "ea21dcc0-3067-41ad-a212-65ecc4b2ef55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/GithubRedTeam/99885", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18963_analyst\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a minh3102011\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-27 02:45:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-27T04:00:04.982633Z"}, {"uuid": "0e2005ca-75cb-46e6-b172-3586ed86ff54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/Ks6sPRK7rGEZMA3UBlp7GLmJzLFcjQs_KZ-4Nh0Q9BWMtB8", "content": "", "creation_timestamp": "2026-08-25T09:00:04.823765Z"}, {"uuid": "30d8077d-9bfe-426d-82dc-6dffa4b32269", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/qhr7w023-vn7u1_ejg3FfnGZ1vCO9Tv-EvHPiDFbLb3J-JQ", "content": "", "creation_timestamp": "2026-08-29T00:00:16.559695Z"}, {"uuid": "ee8d3d5b-bf3a-41ae-832c-0976b356e6f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/cyberok_news/250", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Account Takeover \u0432 Keycloak\n(CVE-2026-18963)\n\n\u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u043d\u0430 \u043b\u044e\u0431\u0443\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u0437\u043d\u0430\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 email. \u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f.\n\n\u2796\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0432 \u043f\u043e\u0442\u043e\u043a\u0435 \u0441\u0431\u0440\u043e\u0441\u0430 \u043f\u0430\u0440\u043e\u043b\u044f reset-credentials, \u0432 \u043c\u0435\u0442\u043e\u0434\u0435 ResetCredentialEmail.action(). \u041f\u043e \u0437\u0430\u043c\u044b\u0441\u043b\u0443 \u043e\u043d \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442 \u0448\u0430\u0433 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e e-mail \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0435\u0440\u0435\u0448\u0451\u043b \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0438\u0437 \u043f\u0438\u0441\u044c\u043c\u0430 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a action-\u0442\u043e\u043a\u0435\u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u043b \u0432 \u0441\u0435\u0441\u0441\u0438\u044e ACTION_TOKEN_USER_ID.\n\n\u041d\u043e \u043c\u0435\u0442\u043e\u0434 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043d\u0438 \u0442\u043e\u043a\u0435\u043d, \u043d\u0438 \u044d\u0442\u043e\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 - \u043e\u043d \u0431\u0435\u0437\u0443\u0441\u043b\u043e\u0432\u043d\u043e \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u043e\u0447\u0442\u0443 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043d\u043e\u0439 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u0435\u0442 \u043f\u043e\u0442\u043e\u043a \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f:\n\n    @Override\n    public void action(AuthenticationFlowContext context) {\n        context.getUser().setEmailVerified(true);\n        context.success();\n    }\n\n\u0414\u043e\u0442\u044f\u043d\u0443\u0442\u044c\u0441\u044f \u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0448\u0430\u0433\u0430 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0442\u043e, \u043a\u0430\u043a \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u044d\u043a\u0440\u0430\u043d\u0430 \u0432\u044b\u0431\u043e\u0440\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0432\u0445\u043e\u0434\u0430: Keycloak \u0434\u0435\u0440\u0436\u0438\u0442 \u0435\u0433\u043e \u043a\u0430\u043a \u00ab\u0437\u0430\u043b\u0438\u043f\u0430\u044e\u0449\u0438\u0439\u00bb \u0430\u0442\u0440\u0438\u0431\u0443\u0442 \u0441\u0435\u0441\u0441\u0438\u0438 (AUTHENTICATION_SELECTOR_SCREEN_DISPLAYED), \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0448\u0430\u0433\u0430 \u0441 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u043e e-mail \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0438 \u043f\u043e\u0441\u043b\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043f\u0438\u0441\u044c\u043c\u0430.\n\n\u0410\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0430\u0442\u0430\u043a\u0438 \ud83e\udd29\n\n1\ufe0f\u20e3 \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u0435\u0442 \u0441\u0431\u0440\u043e\u0441 \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0436\u0435\u0440\u0442\u0432\u044b (\u0436\u0435\u0440\u0442\u0432\u0435 \u0443\u0445\u043e\u0434\u0438\u0442 \u0448\u0442\u0430\u0442\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e, \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f)\n2\ufe0f\u20e3 \u0427\u0435\u0440\u0435\u0437 tryAnotherWay=on \u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a reset-credentials \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0448\u0430\u0433 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f e-mail \u0438 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u0435\u0433\u043e action(), \u043c\u0438\u043d\u0443\u044f authenticate().\n3\ufe0f\u20e3 \u041c\u0435\u0442\u043e\u0434 \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u043e\u0447\u0442\u0443 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u0439, \u043f\u043e\u0442\u043e\u043a \u0443\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 UPDATE_PASSWORD\n4\ufe0f\u20e3 \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u0442\u0430\u0432\u0438\u0442 \u043d\u043e\u0432\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u0431\u0435\u0437 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u043e\u0447\u0442\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0438 \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u043a\u0430 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435\n\n\u041f\u0430\u0442\u0447 \u0447\u0438\u043d\u0438\u0442 \u043e\u0431\u0435 \u043f\u0440\u0438\u0447\u0438\u043d\u044b: ResetCredentialEmail.action() \u0442\u0435\u043f\u0435\u0440\u044c \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437 \u0441\u0435\u0441\u0441\u0438\u0438 \u0441 ACTION_TOKEN_USER_ID (\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0435 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0438\u0437 \u043f\u0438\u0441\u044c\u043c\u0430), \u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u044d\u043a\u0440\u0430\u043d\u0430 \u0432\u044b\u0431\u043e\u0440\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0432\u0445\u043e\u0434\u0430 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u00ab\u0437\u0430\u043b\u0438\u043f\u0430\u0435\u0442\u00bb \u043d\u0430 \u0432\u0435\u0441\u044c \u043f\u043e\u0442\u043e\u043a - \u043e\u043d\u043e \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043e \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0448\u0430\u0433\u0443.\n\n\u0423\u0441\u043b\u043e\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438:\n\u23fa\u0412 realm \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f Forgot Password\n\n\ud83d\udcac \u041a \u0442\u043e\u043c\u0443 \u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC , \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0435\u0441\u0442\u044c  \u0444\u043b\u0430\u0433 --safe-check \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041e\u043d \u0448\u043b\u0435\u0442 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u044e\u0437\u0435\u0440\u043d\u0435\u0439\u043c \u0438 \u0441\u043c\u043e\u0442\u0440\u0438\u0442, \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043b\u0438 email-gate \u0432 reset-\u043f\u043e\u0442\u043e\u043a\u0435. \n\n\ud83d\udd3a \u041a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c - 9.1 CVSS 3.1 (Critical)\n\n\u23faCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n\u23faCWE-640 (Weak Password Recovery Mechanism)\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u23faUpstream Keycloak: <=26.7.1\n\u23faRed Hat build of Keycloak: 26.4.x < 26.4.15, 26.6.x < 26.6.6\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438:\n\u23fa\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\u23fa\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u0441\u043b\u0435\u0434\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 reset-credentials)\n\n\u041f\u0430\u0442\u0447:\n\n\u270526.7.2 - \u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0432\u0435\u0442\u043a\u0430\n\u270526.6.6 / 26.4.15 - \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u044b (RHBK)\n\n\u2796\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043c\u0435\u0440\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432\u044b\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e Forgot password \u0432\u043e \u0432\u0441\u0435\u0445 realm-\u0430\u0445.\n\n\ud83d\udd17 CVE - https://nvd.nist.gov/vuln/detail/CVE-2026-18963\n\ud83d\udd17 \u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442: https://github.com/Snizi/CVE-2026-18963-Exploit\n\ud83d\udd17 GitHub: https://github.com/keycloak/keycloak/issues/51833\n\ud83d\udd17 \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0435\u0441\u0435\u0440\u0447: https://www.pruva.dev/reproductions/REPRO-2026-00337", "creation_timestamp": "2026-08-29T00:00:27.843177Z"}, {"uuid": "7d6ef9cd-de4a-4198-a732-1e0dbfceb8cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/cyberok_news/250", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Account Takeover \u0432 Keycloak\n(CVE-2026-18963)\n\n\u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u043d\u0430 \u043b\u044e\u0431\u0443\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u0437\u043d\u0430\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 email. \u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f.\n\n\u2796\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0432 \u043f\u043e\u0442\u043e\u043a\u0435 \u0441\u0431\u0440\u043e\u0441\u0430 \u043f\u0430\u0440\u043e\u043b\u044f reset-credentials, \u0432 \u043c\u0435\u0442\u043e\u0434\u0435 ResetCredentialEmail.action(). \u041f\u043e \u0437\u0430\u043c\u044b\u0441\u043b\u0443 \u043e\u043d \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442 \u0448\u0430\u0433 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e e-mail \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0435\u0440\u0435\u0448\u0451\u043b \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0438\u0437 \u043f\u0438\u0441\u044c\u043c\u0430 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a action-\u0442\u043e\u043a\u0435\u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u043b \u0432 \u0441\u0435\u0441\u0441\u0438\u044e ACTION_TOKEN_USER_ID.\n\n\u041d\u043e \u043c\u0435\u0442\u043e\u0434 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043d\u0438 \u0442\u043e\u043a\u0435\u043d, \u043d\u0438 \u044d\u0442\u043e\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 - \u043e\u043d \u0431\u0435\u0437\u0443\u0441\u043b\u043e\u0432\u043d\u043e \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u043e\u0447\u0442\u0443 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043d\u043e\u0439 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0433\u0430\u0435\u0442 \u043f\u043e\u0442\u043e\u043a \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f:\n\n    @Override\n    public void action(AuthenticationFlowContext context) {\n        context.getUser().setEmailVerified(true);\n        context.success();\n    }\n\n\u0414\u043e\u0442\u044f\u043d\u0443\u0442\u044c\u0441\u044f \u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0448\u0430\u0433\u0430 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0442\u043e, \u043a\u0430\u043a \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u044d\u043a\u0440\u0430\u043d\u0430 \u0432\u044b\u0431\u043e\u0440\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0432\u0445\u043e\u0434\u0430: Keycloak \u0434\u0435\u0440\u0436\u0438\u0442 \u0435\u0433\u043e \u043a\u0430\u043a \u00ab\u0437\u0430\u043b\u0438\u043f\u0430\u044e\u0449\u0438\u0439\u00bb \u0430\u0442\u0440\u0438\u0431\u0443\u0442 \u0441\u0435\u0441\u0441\u0438\u0438 (AUTHENTICATION_SELECTOR_SCREEN_DISPLAYED), \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0448\u0430\u0433\u0430 \u0441 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435\u043c \u043f\u043e e-mail \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0438 \u043f\u043e\u0441\u043b\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043f\u0438\u0441\u044c\u043c\u0430.\n\n\u0410\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0430\u0442\u0430\u043a\u0438 \ud83e\udd29\n\n1\ufe0f\u20e3 \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u0435\u0442 \u0441\u0431\u0440\u043e\u0441 \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0436\u0435\u0440\u0442\u0432\u044b (\u0436\u0435\u0440\u0442\u0432\u0435 \u0443\u0445\u043e\u0434\u0438\u0442 \u0448\u0442\u0430\u0442\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e, \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f)\n2\ufe0f\u20e3 \u0427\u0435\u0440\u0435\u0437 tryAnotherWay=on \u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a reset-credentials \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0448\u0430\u0433 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f e-mail \u0438 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u0435\u0433\u043e action(), \u043c\u0438\u043d\u0443\u044f authenticate().\n3\ufe0f\u20e3 \u041c\u0435\u0442\u043e\u0434 \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u043e\u0447\u0442\u0443 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u0439, \u043f\u043e\u0442\u043e\u043a \u0443\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 UPDATE_PASSWORD\n4\ufe0f\u20e3 \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u0442\u0430\u0432\u0438\u0442 \u043d\u043e\u0432\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u0431\u0435\u0437 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u043e\u0447\u0442\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0438 \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u043a\u0430 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435\n\n\u041f\u0430\u0442\u0447 \u0447\u0438\u043d\u0438\u0442 \u043e\u0431\u0435 \u043f\u0440\u0438\u0447\u0438\u043d\u044b: ResetCredentialEmail.action() \u0442\u0435\u043f\u0435\u0440\u044c \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437 \u0441\u0435\u0441\u0441\u0438\u0438 \u0441 ACTION_TOKEN_USER_ID (\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0435 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435 \u0438\u0437 \u043f\u0438\u0441\u044c\u043c\u0430), \u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u044d\u043a\u0440\u0430\u043d\u0430 \u0432\u044b\u0431\u043e\u0440\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0432\u0445\u043e\u0434\u0430 \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u00ab\u0437\u0430\u043b\u0438\u043f\u0430\u0435\u0442\u00bb \u043d\u0430 \u0432\u0435\u0441\u044c \u043f\u043e\u0442\u043e\u043a - \u043e\u043d\u043e \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043e \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 \u0448\u0430\u0433\u0443.\n\n\u0423\u0441\u043b\u043e\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438:\n\u23fa\u0412 realm \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f Forgot Password\n\n\ud83d\udcac \u041a \u0442\u043e\u043c\u0443 \u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC , \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0435\u0441\u0442\u044c  \u0444\u043b\u0430\u0433 --safe-check \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041e\u043d \u0448\u043b\u0435\u0442 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u044e\u0437\u0435\u0440\u043d\u0435\u0439\u043c \u0438 \u0441\u043c\u043e\u0442\u0440\u0438\u0442, \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043b\u0438 email-gate \u0432 reset-\u043f\u043e\u0442\u043e\u043a\u0435. \n\n\ud83d\udd3a \u041a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c - 9.1 CVSS 3.1 (Critical)\n\n\u23faCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n\u23faCWE-640 (Weak Password Recovery Mechanism)\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u23faUpstream Keycloak: <=26.7.1\n\u23faRed Hat build of Keycloak: 26.4.x < 26.4.15, 26.6.x < 26.6.6\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438:\n\u23fa\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\u23fa\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u0441\u043b\u0435\u0434\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 reset-credentials)\n\n\u041f\u0430\u0442\u0447:\n\n\u270526.7.2 - \u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0432\u0435\u0442\u043a\u0430\n\u270526.6.6 / 26.4.15 - \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u044b (RHBK)\n\n\u2796\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043c\u0435\u0440\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432\u044b\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e Forgot password \u0432\u043e \u0432\u0441\u0435\u0445 realm-\u0430\u0445.\n\n\ud83d\udd17 CVE - https://nvd.nist.gov/vuln/detail/CVE-2026-18963\n\ud83d\udd17 \u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442: https://github.com/Snizi/CVE-2026-18963-Exploit\n\ud83d\udd17 GitHub: https://github.com/keycloak/keycloak/issues/51833\n\ud83d\udd17 \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0435\u0441\u0435\u0440\u0447: https://www.pruva.dev/reproductions/REPRO-2026-00337", "creation_timestamp": "2026-08-28T06:00:04.721757Z"}, {"uuid": "f082250e-f2b0-4604-a1a3-73ef5fb29e52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mtvj3ky6dj2x", "content": "Kritieke kwetsbaarheid in Keycloak maakt accountovername mogelijk\n\nRed Hat heeft een ernstige beveiligingslek ontdekt in Red Hat Build van Keycloak, met de identificatie CVE-2026-18963 en een CVSS-score van 9.1. De kwetsbaarheid, die publiek werd gemaakt op 17 augustus 2026, m...", "creation_timestamp": "2026-08-25T09:31:06.534784Z"}, {"uuid": "8a341ae2-64e7-43e9-9f31-96d9e04716f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/F30.chaos.social.ap.brid.gy/post/3mtvlgbesqds2", "content": "CVE-2026-18963: #Keycloak arbitrary account takeover via session confusion using simple HTTP requests. \ud83d\ude31\n\nNice find and (allegedly) not even AI-powered at its core.\nA working exploit is publicly available. Given Keycloak's widespread use in critical auth systems, this appears to be flying a bit [\u2026]", "creation_timestamp": "2026-08-25T10:13:00.661831Z"}, {"uuid": "c2c7b148-00e2-4dd8-ada7-6ffaafac043b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/477", "content": "CVE-2026-18963 Keycloak reset-credentials bypass \u2192 unauthenticated account takeover\u00a0CVSS 9.1\u00a0| Affected: Keycloak 26.0.0 \u2013 26.7.1\npoc: https://github.com/prot0tw/Keycloak_CVE-2026-18963_PoC", "creation_timestamp": "2026-08-25T12:00:04.332194Z"}, {"uuid": "af8b83e9-6a9c-4718-b492-e87a4651aa4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/clever.cloud/post/3mtvtuzm6ic2r", "content": "Keycloak 26.7.2 est disponible sur Clever Cloud et corrige la CVE-2026-18963, une vuln\u00e9rabilit\u00e9 critique (CVSS v3.1 : 9,1).\n\nNous recommandons de mettre \u00e0 jour vos add-ons d\u00e8s que possible.\n\nTous les d\u00e9tails dans notre changelog : www.clever.cloud/developers/c...", "creation_timestamp": "2026-08-25T12:44:19.708239Z"}, {"uuid": "540a3ed0-53ba-4b05-9860-1e02f2fd8f6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mtvtwiw3pf26", "content": "\ud83d\udd17 CVE : CVE-2026-14613, CVE-2026-15571, CVE-2026-15945, CVE-2026-17048, CVE-2026-18963, CVE-2026-45292, CVE-2026-59888, CVE-2026-59889", "creation_timestamp": "2026-08-25T12:45:08.485626Z"}, {"uuid": "8a078185-1429-4887-8004-da0899a1c5cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mttc2azoyb2s", "content": "Keycloak\u2019s reset-flow flaw allows unauthenticated attackers to reset any account password. Patch ASAP. CVE-2026-18963 #Keycloak #SecurityFlaw #IAM #CVE2026 #RedHat #Cybersecurity https://thedailytechfeed.com/critical-keycloak-flaw-lets-attackers-reset-any-password-without-authentication/", "creation_timestamp": "2026-08-24T12:19:46.715591Z"}, {"uuid": "488454e1-ac43-4980-827e-6e4d7ae60615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-18963.yaml", "content": "", "creation_timestamp": "2026-08-28T00:00:07.178027Z"}, {"uuid": "56566ab8-52c9-4ef0-a736-70399386c6f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mttduge3tk2y", "content": "\ud83e\udd16 CVE-2026-18963 (CVSS 9.1): unauthenticated account takeover in Keycloak. Flawed reset-credentials flow lets attackers force a password reset without the email token \u2014 any account, incl. admins. Fixed in 26.7.2.\nhttps://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html", "creation_timestamp": "2026-08-24T12:52:18.286003Z"}, {"uuid": "677d3f00-70a9-4af1-81cc-aece450979bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0326", "content": "Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak. De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen. Door deze kwetsbaarheid valt het e-mailverificatieproces bij wachtwoordreset te omzeilen en wachtwoorden van gebruikers te wijzigen.\n\nIn Keycloak zijn daarnaast kwetsbaarheden aanwezig in de Fine-Grained Admin Permissions (FGAP) v2, waardoor bepaalde beheerders met beperkte permissies metadata van verborgen groepen kunnen inzien en details van ongeautoriseerde oudergroepen kunnen blootstellen. Verder kunnen geauthenticeerde aanvallers via een legacy client-initiated account-linking endpoint CSRF-bescherming omzeilen en accounts overnemen. Ook kunnen gedelegeerde beheerders met alleen leesrechten client secrets uitlezen door een fout in de secret rotation. Voor OpenTelemetry Java was er een kwetsbaarheid waarbij het ontbreken van limieten op baggage headers leidde tot onbegrensd geheugen- en CPU-gebruik, wat Denial-of-Service kan veroorzaken. Bij Jackson-libraries is een bypass van de @JsonIgnore annotatie in Java Records vastgesteld, waardoor ongewenste toewijzing aan constructorparameters mogelijk is. Ook zijn er bypasses van @JsonIgnoreProperties, ontbrekende view guards op @JsonUnwrapped en ongeautoriseerde schrijfacties op velden met @JsonView. Oracle Database Server's Fleet Patching and Provisioning component is eveneens getroffen door een kwetsbaarheid die ongeautoriseerde data toegang of Denial-of-Service kan veroorzaken.", "creation_timestamp": "2026-08-25T16:00:49.655781Z"}, {"uuid": "08f18a97-30dd-4c1e-8633-c28f887f6145", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mttenwdr322k", "content": "Keycloak\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u30ea\u30bb\u30c3\u30c8\u6a5f\u80fd\u306b\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u4efb\u610f\u306e\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4e57\u3063\u53d6\u308c\u308b\u8106\u5f31\u6027\uff08CVE-2026-18963\uff09\u304c\u78ba\u8a8d\u3055\u308c\u3001\u4fee\u6b63\u30d1\u30c3\u30c1\u304c\u516c\u958b\u3055\u308c\u307e\u3057\u305f\u3002", "creation_timestamp": "2026-08-24T13:06:34.695361Z"}, {"uuid": "01e9d9a4-f727-43b2-a452-4dd443386979", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/y_ppx2WWa40cV5hBHui4bTL2VMdA_tcaI4VaugdhOfmt8Lg", "content": "", "creation_timestamp": "2026-09-02T01:00:04.811766Z"}, {"uuid": "7efb25a3-73fc-4fb7-9315-1e5af0e903fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://t.me/proxy_bar/3610", "content": "CVE-2026-18963 KeyCloak \n*\nreset-credentials bypass \u2192 unauthenticated account takeover\n\nPoCexploit", "creation_timestamp": "2026-09-02T18:00:05.657204Z"}, {"uuid": "ff374edb-84a1-4fe4-a1fb-fb24dd2f0b43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/zg4wR79y8Xs5TR-sEF4ufViDE8nGerP6bqE6yl_hOH2_qzw", "content": "", "creation_timestamp": "2026-09-03T00:00:40.683290Z"}, {"uuid": "9e3fa893-db8f-4f4e-a6a5-10c970b95929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3610", "content": "CVE-2026-18963 KeyCloak \n*\nreset-credentials bypass \u2192 unauthenticated account takeover\n\nPoCexploit", "creation_timestamp": "2026-09-03T00:00:40.413492Z"}, {"uuid": "47caedc4-7849-4f8b-bd45-70cf0285ea65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/geFIdEurthJC81uvedAy7Je7bmf61756WHWGo7im76vrTZM", "content": "", "creation_timestamp": "2026-09-03T00:00:43.051347Z"}, {"uuid": "14f0053b-849d-4fe4-a706-57d207eceb52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/y_ppx2WWa40cV5hBHui4bTL2VMdA_tcaI4VaugdhOfmt8Lg", "content": "", "creation_timestamp": "2026-09-03T00:01:00.116458Z"}, {"uuid": "d023ccca-91c8-430c-b884-7752302da80d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/5og8BXedCn3iZYkJxzPjmGhgIbYV3bjM5ZKENJCDj4t23UY", "content": "", "creation_timestamp": "2026-09-06T04:00:05.598619Z"}, {"uuid": "94ce0d13-9875-40a1-9ef3-b46cc8cecb2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "creation_timestamp": "2026-09-06T12:00:06.598294Z"}, {"uuid": "9a9401ee-4b39-469a-81a7-b55db0dd5445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "creation_timestamp": "2026-09-07T01:00:15.787638Z"}, {"uuid": "ddd6722d-e3d6-4ada-927a-1fa8c7213caa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "published-proof-of-concept", "source": "Telegram/5og8BXedCn3iZYkJxzPjmGhgIbYV3bjM5ZKENJCDj4t23UY", "content": "", "creation_timestamp": "2026-09-07T01:00:36.218350Z"}, {"uuid": "73c87621-8e4f-45e0-8e54-133afa4bcaf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/6169KQU6yPxEFdBuAglS8vS7rNLj0LU9lqsRd_pNInN39AI", "content": "", "creation_timestamp": "2026-09-07T06:00:06.203364Z"}, {"uuid": "a058c103-fe20-4ab9-9dbe-a2e896cc21c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "Telegram/6169KQU6yPxEFdBuAglS8vS7rNLj0LU9lqsRd_pNInN39AI", "content": "", "creation_timestamp": "2026-09-08T00:00:58.422822Z"}, {"uuid": "abb62d51-64dc-40aa-8cac-039801edc30c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3muzh7c3rn22z", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-18963: A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access \u2026\nCVSS 9.1 \u00b7 EPSS 3.2%\nhttps://beta.vulnsea.com/cve/CVE-2026-18963\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-08T16:33:14.536266Z"}, {"uuid": "335d5c7b-73d4-4a30-add6-2e7dfc841d3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18963", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mv2czfmano24", "content": "Two critical Siemens vulnerabilities (CVE-2026-18963, CVE-2026-50093) allow account takeover and root access. See affected versions and fixes.\n\n#Siemens #CyberSecurity #ICS #OTSecurity #CVE #IndustrialEdge #Vulnerability #InfoSec", "creation_timestamp": "2026-09-09T00:51:02.192524Z"}]}