Keycloak Realm 'Forgot Password' Re-enabled on Unpatched Version

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•3

Detects changes to Keycloak realm configurations that enable the 'Forgot password' (resetPasswordAllowed) setting. This specific configuration change is associated with temporary mitigation strategies for CVE-2026-18963 on known-vulnerable versions of Keycloak.