Summary by Shisones
Unauthenticated account takeover on NASA’s SMCE Keycloak identity provider (CVE-2026-18963). The vulnerable build let an attacker who only knew a target’s username or email bypass the password reset flow’s email verification step, using a stale authentication note from an earlier step. That meant setting a new password on any account, including admins, with no token and no victim interaction. Since this IdP federates a large set of downstream services, one account takeover extended across the whole estate, and a master realm takeover would have meant full Keycloak admin access. NASA has deployed the vendor fix and I’ve retested both affected realms, the bypass is no longer reachable.