A critical vulnerability, CVE-2026-18963, has been discovered in Keycloak 26.7.1 that allows an unauthenticated attacker to take over any user account. The flaw exploits a bypass in the reset-credentials flow, enabling unauthorized access. Organizations using affected Keycloak versions should prioritize patching to prevent account compromise.