Live › vulnerability › CVE-2026-4633
Go to dashboardKeycloak's identity-first login returns different error messages depending on whether a user exists, when Organizations are enabled. A remote attacker can use this to confirm which usernames or emails have accounts, enabling user enumeration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| org.keycloak:keycloak-services | maven | >= 26.5.0, < 26.6.1 | 26.6.1 |
| org.keycloak:keycloak-services | maven | < 26.4.12 | 26.4.12 |
| redhat build of keycloak | vendor | – | – |
Upgrade maven:org.keycloak:keycloak-services to 26.6.1 for the 26.5.x line, or to 26.4.12 for versions below 26.4.12.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
This page as .md · .json · in your agent: get_signal("CVE-2026-4633")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.