> TritonInfoSec News
Home / Aug 25, 2026 / Story
0
#2 The Hacker News general August 24, 2026 at 11:56 UTC

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

By [email protected] (The Hacker News)

AI Summary

A critical vulnerability (CVE-2026-18963, CVSS 9.1) in Keycloak, the widely-deployed open-source identity and access management server maintained by Red Hat, allows unauthenticated remote attackers to take over any user account by forcing a password reset. Red Hat and the Keycloak project have released patches, making immediate upgrade essential for any organization using Keycloak for SSO or OAuth flows.

Read full article → https://thehackernews.com/2026/08/critical-keycloa…

Relevance score: 85.0/100

# More from August 25

  1. 1
    Iran-Linked Hackers Shut Down UK Power Plant for Four Days SecurityWeek
  2. 3
    CISA orders urgent patching of actively exploited Zimbra flaw BleepingComputer
  3. 4
    Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts SecurityWeek
  4. 5
    91 Vulnerabilities Patched in Spring Application Framework SecurityWeek
  5. 6
    TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy SecurityWeek
  6. 7
    UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit The Hacker News
  7. 8
    Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor The Hacker News
  8. 9
    Hackers target WordPress sites in miniOrange auth bypass attacks BleepingComputer
  9. 10
    Unpatched Calix flaw lets hackers bypass NAT to expose internal devices BleepingComputer