EUVD-2026-14400
GHSA-rhgq-f8x5-j2jc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.0.
DescriptionCVE.org
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
AnalysisAI
Keycloak contains an information disclosure vulnerability in the identity-first login flow when Organizations are enabled, where differential error messages allow remote attackers to enumerate valid user accounts without authentication. The vulnerability affects Red Hat Build of Keycloak across multiple versions, and while the CVSS score is low (3.7), the attack requires only network access with no user interaction. This user enumeration flaw could facilitate credential stuffing, phishing, or social engineering campaigns by confirming the existence of target accounts.
Technical ContextAI
The vulnerability exists in Keycloak's identity-first authentication flow, a feature that separates user identification from credential verification. When the Organizations feature is enabled, the identity-first logic generates distinguishable error responses for existing versus non-existing user accounts during the initial login step. This violates secure error handling principles outlined in CWE-209 (Information Exposure Through an Error Message), where error messages inadvertently leak sensitive information about system state. The affected product is Red Hat Build of Keycloak (CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak), an enterprise identity and access management solution used for single sign-on (SSO), authentication, and authorization across organizations.
RemediationAI
Apply the security patch released by Red Hat for Keycloak as documented in the security advisory (https://access.redhat.com/security/cve/CVE-2026-4633); specific patched versions should be obtained from Red Hat's advisory page. Until patching is possible, implement compensating controls by disabling the Organizations feature or identity-first login flow if not operationally required, and restrict login endpoints to trusted IP ranges via network firewall or reverse proxy to reduce exposure. Additionally, monitor authentication logs for anomalous patterns of failed login attempts against both valid and invalid usernames, which may indicate active user enumeration attacks. Implement rate limiting on login endpoints to slow brute-force user enumeration attempts.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today