EUVD-2026-80855
GHSA-h87q-rx56-87wm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify victim username in brokered realm
-
DeliveryRegister matching username on external IdP
-
ExploitInitiate first-broker-login to Keycloak
-
ExecutionTrigger username collision in linking flow
-
ImpactLegitimate user locked out (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires Keycloak to be configured as an identity broker with an external identity provider and the first-broker-login flow performing account linking by username - this is the specific deployment mode the flaw lives in; realms without external IdP brokering are not exposed. The attacker must be able to register a chosen (matching) username on a trusted external provider and must know or guess the victim's Keycloak username. No authentication to Keycloak itself and no victim interaction is required (PR:N/UI:N), but the impact is limited to denying one targeted user access (A:L) with no data exposure or account compromise. Fixed in Red Hat build of Keycloak 26.4.16 and 26.6.7. |
| Impact | This is a genuinely LOW-priority issue despite its network-reachable vector, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) correctly caps impact at A:L with no confidentiality or integrity effect - the flaw does NOT allow account takeover, credential theft, or authentication bypass in the classic sense; it only allows a targeted denial of service (locking a legitimate user out of their account). EPSS, KEV, POC and SSVC data are all ABSENT from the input, so exploitation likelihood cannot be quantified from scored feeds; based on available data there is no public exploit identified and no evidence of active exploitation. The CWE-287 (Improper Authentication) classification and the 'Authentication Bypass' tag overstate the mechanism - this is really a username-collision flaw in identity-broker account linking that produces a lockout, not a privilege gain. Net: a legitimate but low-severity availability bug; patch on normal cadence, not an emergency. |
| Exploit ScenarioDerived | A target organization uses Keycloak as an identity broker with first-broker-login (account linking to an external IdP by username). An attacker enumerates or guesses a victim's username, then registers that same username on the permitted external identity provider and initiates a broker login, triggering a username collision in Keycloak that locks the legitimate user out of their account. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.
RemediationAI
Vendor-released patch: upgrade to Red Hat build of Keycloak 26.4.16 or 26.6.7 (package builds 26.4.16-2 and 26.6.7-3, superseding 26.4-26 and 26.6-20), delivered via the errata RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278 and RHSA-2026:68280 and documented at https://access.redhat.com/security/cve/CVE-2026-19607. Where an immediate upgrade is not possible, compensate by changing the brokering configuration rather than relying on generic hardening: disable username-based account linking in the identity provider's first-login flow and switch to an attribute that an attacker on the external provider cannot self-assert for the victim, such as a verified email address - the trade-off is that existing users whose broker links depend on username matching may need to re-link; alternatively, remove or restrict the external IdP as a trusted broker for the realm, which eliminates the exposure entirely but breaks federated login for those users; and where a fixed IdP is trusted, constrain who may create accounts on that provider. Monitor Keycloak logs for repeated first-broker-login collisions or lockout reports for a single username as an indicator of attempted exploitation. No public exploit code has been identified at time of analysis, so patching can proceed on a normal low-risk cadence.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Keycloak's first-broker-login flow is the code path executed the very first time a user authenticates through an external identity provider in a brokered realm; it decides whether to link the incoming external identity to an existing local account. In the affected Red Hat build of Keycloak 26.4 and 26.6 builds, that linking logic can be forced into a username collision: if an attacker creates an account on the trusted external provider whose asserted username matches a legitimate Keycloak user's local username, the broker flow resolves the match incorrectly and the legitimate user is subsequently denied access to their own account. The root cause class is CWE-287 (Improper Authentication) - the federated identity assertion is accepted as sufficient proof of identity without adequately binding it to the already-existing local account. This is a logic/state-handling flaw in the brokering layer rather than a memory-safety or injection bug, which is why the assessed vector shows no confidentiality or integrity impact and only a low availability effect on the targeted account. Only realms with an external IdP configured and username-based linking enabled are exposed; realms that do not broker to an external provider are unaffected.
Know when Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote unauthenticated attacker can trigger a username collision without victim interaction, but the sole impact is a targeted single-account lockout (A:L), with no confidentiality or integrity effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severit
Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using
Exploit-DB