Unauthenticated Keycloak Password Reset Targeting Admin Accounts

Arnold Chan@slaz

•updated Sep 12, 2026•2•0•4

Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).