authentication-bypass 1 CVE-2026-18963 - Keycloak reset-credentials bypass → full account takeover Sep 21, 2026