Keycloak reset-credentials POST missing action-token parameter

Arnold Chan@slaz

•updated Sep 5, 2026•1•0•9

Detects anomalous HTTP POST requests to the Keycloak '/login-actions/reset-credentials' endpoint that lack required action tokens (e.g., 'key=' or 'execution=' parameters). This behavior is indicative of an exploitation attempt targeting CVE-2026-18963, potentially aimed at bypassing authentication or triggering unauthorized credential reset flows.