Keycloak reset-credentials flow reaches UPDATE_PASSWORD without prior email verification (CVE-2026-18963)
Detects Keycloak password reset attempts (UPDATE_PASSWORD) where the user has not performed the required preceding email verification (SEND_RESET_PASSWORD) and lacks a valid action-token. This pattern suggests an attempt to bypass the standard password reset workflow.
Microsoft Sentinel (KQL)
