Keycloak Reset-Credentials Flow Bypass Account Takeover (CVE-2026-18963)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.