A flaw was found in the Keycloak reset-credentials authentication flow. The vulnerability exists in the way the flow state is managed, allowing an unauthenticated remote attacker to bypass the email verification requirement. By sending a specially crafted request to the reset-credentials endpoint, an attacker can transition the authentication session directly to the password update phase without possessing the required action token typically sent via email. Successful exploitation allows an attacker to perform a complete account takeover of any user, including administrative accounts, by resetting their password.