PT-2026-27107 · Red Hat · Keycloak

Osidb Bzimport · Published 2026-03-23 · Updated 2026-05-23 · CVE-2026-4633

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak that allows a remote attacker to determine the existence of users, resulting in information disclosure through user enumeration. This occurs due to differential error messages during the identity-first login flow when Organizations are enabled. The issue allows attackers to map accounts for further attacks.

Recommendations Disable Organizations. Disable the identity-first login flow.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-4633

GHSA-RHGQ-F8X5-J2JC

Affected Products

Keycloak

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-4633 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-4633 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2450247 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rhgq-f8x5-j2jc · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/b4558a874fa79341404ae4d2d8f240f22bfed340 · Note
• https://github.com/keycloak/keycloak/commit/b137016cc6dcfd9f59b2aa2e6d73af8b0ebf7c6e · Note
• https://github.com/keycloak/keycloak/issues/47619 · Note
• https://twitter.com/stansecure/status/2058055759875735720 · Twitter Post
• https://twitter.com/autumn_good_35/status/2036489274615624105 · Twitter Post
• https://twitter.com/CVEarity/status/2036118094373097764 · Twitter Post
• https://github.com/keycloak/keycloak/pull/47635 · Note
• https://twitter.com/VolerionSec/status/2036040051004514607 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2037139644614164803 · Twitter Post