A critical vulnerability in Keycloak's reset-credentials (CVE-2026-18963, CVSS 9.1) allows any authenticated user, including administrators, to complete a password reset and set a new password.

A allegation by Turansecurity. Statements are as reported by the cited publishers — not verified by DecisionGateway.

Keycloak'ning reset-credentialsdagi kritik zaiflik (CVE-2026-18963, CVSS 9.1) autentifikatsiyasi istalgan foydalanuvchi (shu jumladan administratorlar) uchun parol tiklashni yakunlash va yangi parol o'rnatish imkonini beradi.