A Critical Keycloak Flaw Puts Millions of Users at Risk of Account Takeover
A severe password reset vulnerability in Keycloak, a popular open-source identity and access management (IAM) solution, has been discovered. The flaw, which affects all Keycloak versions since 2016, allows unauthenticated attackers to reset any user’s password, potentially leading to complete account takeover.
Keycloak is used by many organizations worldwide to manage employee and customer identities across multiple applications and services. According to estimates, over 100 million users rely on Keycloak for authentication purposes alone. This widespread adoption makes the discovered vulnerability particularly concerning, as it could allow malicious actors to compromise a vast number of accounts.
To understand how this flaw works, consider what happens when an attacker exploits the password reset functionality in Keycloak. Normally, when a user attempts to reset their password, they must first provide valid credentials or other authentication factors to verify their identity. However, due to the bug, an attacker can bypass these security checks entirely and initiate the password reset process for any account, without needing any prior knowledge of the target’s login details.
The exploit takes advantage of a misconfigured Keycloak server, which fails to validate the authenticity of incoming requests. This allows an attacker to submit a fake password reset request on behalf of another user, essentially “phoning home” with forged credentials that are accepted by the system as legitimate. The vulnerability is not limited to any specific version or configuration; it affects all Keycloak installations since 2016.
The potential impact of this flaw cannot be overstated, given the sheer number of users and organizations relying on Keycloak for secure identity management. In a worst-case scenario, an attacker could use this exploit to create master accounts with elevated privileges, thereby gaining unfettered access to sensitive information across multiple applications and systems.
To mitigate this risk, Keycloak administrators are urged to immediately update their servers to the latest patched version, which addresses the vulnerability. Users are also advised to monitor their account activity closely for any suspicious signs of unauthorized access or password resets initiated from untrusted sources.
Source: The Hacker News — 2026-08-24