VDB
CVE-2026-18963
CVE-2026-18963
PUBLISHED
CVSS 9.100000381469727 CRITICAL
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
EPSS 6.41% · 93.7th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C/CR:M/IR:M/AR:L/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:L/MA:N
EPSS Score
6.41%
93.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ABB | ABB dynovaPRO™ cloud system < 2026-08-27 12:00 (CEST) |
Timeline
- Aug 18, 2026 CVE Published
- Aug 19, 2026 Distribution Patch
- Aug 19, 2026 Security Advisory
- Aug 19, 2026 Distribution Patch
- Aug 19, 2026 Security Advisory
- Aug 19, 2026 Distribution Patch
- Aug 19, 2026 Security Advisory
- Aug 19, 2026 Distribution Patch
- Aug 19, 2026 Security Advisory
- Aug 20, 2026 VulnCheck XDB Entry
- Aug 22, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score