Scripted Keycloak Reset-Credentials Flow Abuse (CVE-2026-18963)

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•7

Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.