PT-2026-27107 · Red Hat · Keycloak

Osidb Bzimport · Publicado 2026-03-23 · Atualizado 2026-05-23 · CVE-2026-4633

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak that allows a remote attacker to determine the existence of users, resulting in information disclosure through user enumeration. This occurs due to differential error messages during the identity-first login flow when Organizations are enabled. The issue allows attackers to map accounts for further attacks.

Recommendations Disable Organizations. Disable the identity-first login flow.

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2026-4633

GHSA-RHGQ-F8X5-J2JC

Produtos afetados

Keycloak

Referências · 14

• https://github.com/keycloak/keycloak/pull/47635 · Nota
• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/issues/47619 · Nota
• https://github.com/keycloak/keycloak/commit/b137016cc6dcfd9f59b2aa2e6d73af8b0ebf7c6e · Nota
• https://github.com/keycloak/keycloak/commit/b4558a874fa79341404ae4d2d8f240f22bfed340 · Nota
• https://twitter.com/VolerionSec/status/2036040051004514607 · Publicação no Twitter
• https://bugzilla.redhat.com/show_bug.cgi?id=2450247 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-4633 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2026-4633 · Aviso do Fabricante
• https://twitter.com/stansecure/status/2058055759875735720 · Publicação no Twitter
• https://twitter.com/autumn_good_35/status/2036489274615624105 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2036118094373097764 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-rhgq-f8x5-j2jc · Aviso do Fabricante
• https://twitter.com/TheRabbitPy/status/2037139644614164803 · Publicação no Twitter