Critical Security Flaw Found in Keycloak Identity Server

Red Hat and the Keycloak project have released patches for a critical security vulnerability, CVE-2026-18963, in the open-source identity and access management server. This flaw, rated 9.1 CVSS, could allow unauthenticated remote attackers to compromise any user account, including administrative ones, by exploiting a weak password recovery mechanism. Users are strongly advised to update to Keycloak version 26.7.2 or apply relevant Red Hat build updates.