Critical Keycloak Flaws Enable Account Takeover and PII Disclosure

Red Hat and the Keycloak project have released critical security updates addressing several vulnerabilities that could lead to full account takeover and exposure of Personally Identifiable Information (PII). The most severe, CVE-2026-18963, allows unauthenticated remote attackers to bypass email verification during the password recovery process, enabling them to reset the password of any user, including administrators.

Technically, the flaws stem from improper state validation in the `reset-credentials` authentication flow and broken access control in the admin REST API. In the case of CVE-2026-17059, restricted admins can enumerate full user profiles by querying role-member endpoints that lack proper visibility filters. These vulnerabilities impact the Red Hat build of Keycloak (RHBK) and upstream Keycloak versions, requiring immediate patching or mitigation to prevent unauthorized access to downstream enterprise applications.