{"id":"CVE-2026-4633","kind":"vulnerability","aliases":["CVE-2026-4633","GHSA-rhgq-f8x5-j2jc"],"related":[],"title":"Keycloak's identity-first login flow exposes user information","description":"A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.","summary":"Keycloak's identity-first login returns different error messages depending on whether a user exists, when Organizations are enabled. A remote attacker can use this to confirm which usernames or emails have accounts, enabling user enumeration.","severity":"low","cvss":3.700000047683716,"epss":0.0037899999879300594,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":["26.6.1"],"affected":">= 26.5.0, < 26.6.1","ecosystem":"maven"},{"name":"org.keycloak:keycloak-services","fixed":["26.4.12"],"affected":"< 26.4.12","ecosystem":"maven"},{"name":"redhat build of keycloak","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-209","identity","java","keycloak","package","self-hosted"],"not_affected_if":["keycloak-below-26.4.0-or-patched-version","organizations-disabled"],"how_to_check":"Check whether the Organizations feature is enabled in the Keycloak realm or server configuration; the sources do not give a specific command or file.\nCheck the keycloak-services version in your build or deployment against the affected ranges.","fix":"Upgrade maven:org.keycloak:keycloak-services to 26.6.1 for the 26.5.x line, or to 26.4.12 for versions below 26.4.12.","status":"open","published_at":"2026-03-23T11:16:25+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T21:49:15+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:49:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade maven:org.keycloak:keycloak-services to 26.6.1 for the 26.5.x line, or to 26.4.12 for versions below 26.4.12.","reach":"internet","impact":"low","summary":"Keycloak's identity-first login returns different error messages depending on whether a user exists, when Organizations are enabled. A remote attacker can use this to confirm which usernames or emails have accounts, enabling user enumeration.","category":"package","who_cares":["keycloak","self-hosted","java","identity"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker learns which user accounts exist, enabling targeted phishing or credential attacks.","analyst_note":"","how_to_check":"Check whether the Organizations feature is enabled in the Keycloak realm or server configuration; the sources do not give a specific command or file.\nCheck the keycloak-services version in your build or deployment against the affected ranges.\nunknown","needs_analyst":false,"not_affected_if":["organizations-disabled","keycloak-below-26.4.0-or-patched-version"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000494,"input_tokens":2871,"output_tokens":414,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-209':35B '-4633':13A,21A 'account':76B 'allow':107C 'attack':65B,88C,109C 'build':31A 'confirm':70B 'cve':11A,19A 'cwe':34B 'depend':53B 'determin':111C 'differ':50B 'differenti':91C 'disclosur':119C 'email':74B 'enabl':62B,77B,104C 'enumer':79B,122C 'error':51B,92C 'exist':58B,113C 'exploit':90C 'expos':8A 'f8x5':17A 'first':5A,47B,98C 'flaw':81C 'flow':7A,100C 'found':83C 'ghsa':15A 'ghsa-rhgq-f8x5-j2jc':14A 'host':42B 'ident':4A,36B,46B,97C 'identity-first':3A,45B,96C 'inform':10A,118C 'j2jc':18A 'java':37B 'keycloak':1A,24A,28A,33A,38B,43B,85C 'keycloak-services':23A,27A 'lead':116C 'login':6A,48B,99C 'messag':52B,93C 'of':32A 'org.keycloak':22A,26A 'organ':60B,102C 'packag':39B 'redhat':30A 'remot':64B,87C 'return':49B 'rhgq':16A 'self':41B 'self-host':40B 'services':25A,29A 'use':67B 'user':9A,57B,78B,115C,121C 'usernam':72B 'vulner':106C 'whether':55B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-23T11:16:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rhgq-f8x5-j2jc","url":"https://github.com/advisories/GHSA-rhgq-f8x5-j2jc","severity":"low","published_at":"2026-03-23T12:30:30+00:00","modified_at":"2026-10-23T00:32:50+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-4633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4633","severity":null,"published_at":"2026-03-23T11:16:25+00:00","modified_at":"2026-10-22T22:18:07+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}