EUVD-2026-80855
GHSA-h87q-rx56-87wm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote unauthenticated attacker can trigger a username collision without victim interaction, but the sole impact is a targeted single-account lockout (A:L), with no confidentiality or integrity effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
AnalysisAI
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires Keycloak to be configured as an identity broker with an external identity provider and the first-broker-login flow performing account linking by username - this is the specific deployment mode the flaw lives in; realms without external IdP brokering are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely LOW-priority issue despite its network-reachable vector, and the signals are consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Red Hat build of Keycloak 26.4.16 or 26.6.7 (package builds 26.4.16-2 and 26.6.7-3, superseding 26.4-26 and 26.6-20), delivered via the errata RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278 and RHSA-2026:68280 and documented at https://access.redhat.com/security/cve/CVE-2026-19607. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severit
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowin
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today