Keycloak shipped 20 CVE fixes across two security releases in 14 days, four of which Red Hat described as leading to account takeover.
The identity and access management project released version 26.7.1 on Aug. 5 and 26.7.2 on Aug. 19, addressing 12 and eight CVEs respectively.
The most serious is CVE-2026-18963, which let an unauthenticated attacker advance the reset-credentials flow straight to the password-setting step without clicking the emailed verification link. Red Hat, the CVE numbering authority for the flaw, assessed it as Critical at CVSS 9.1 and put the root cause down to “improper state validation.”
Two SAML identity brokering flaws in 26.7.1 were both rated Important at 7.4. CVE-2026-16443 disabled signature validation on SAML responses when imported provider metadata lacked key usage attributes, letting an unauthenticated attacker who knows a user’s external identifier forge a response.
CVE-2026-16442 let an attacker controlling a linked upstream identity bypass a restriction meant to permit account linking only, reaching full access to the local account.
The fourth, CVE-2026-15571, involved legacy client-initiated account linking, where a predictable hash let a malicious OpenID Connect client attach an attacker’s external identity to a victim’s account.
Beyond Account Takeover
None has been reported as exploited, a status that can change within days of disclosure for widely deployed open-source infrastructure.
Two other fixes went further in a different direction. CVE-2026-15572 and CVE-2026-16102 each let an attacker with client registration privileges escalate to full administrative control of the realm through Dynamic Client Registration (DCR).
The remaining fixes covered authorization bypasses, information disclosure, fine-grained administration issues, secret disclosure, resource exhaustion and third-party dependency flaws.
Red Hat recommended upgrading. For CVE-2026-18963 it said administrators can temporarily disable the “Forgot password” function across all realms, which removes legitimate self-service password recovery. For CVE-2026-16442, CVE-2026-16443 and CVE-2026-15571 it listed no mitigation at all.
