CVE-2026-4633
Fixed in a distro release EPSS <1%CVSS 3.7
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
Products: Red Hat build of Keycloak 26.4.12, Red Hat Build of Keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.6.1 |
| Maven | org.keycloak:keycloak-services | 26.4.12 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.3-iamguarded-compat | no fix |
| Chainguard | keycloak-26.4 | no fix |
| Chainguard | keycloak-26.4-iamguarded-compat | no fix |
| Chainguard | keycloak-26.5 | 26.5.7-r0 |
| Chainguard | keycloak-26.5-iamguarded-compat | 26.5.7-r0 |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.4 | no fix |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.5 | 26.5.6-r4 |
| Chainguard | keycloak-fips-26.5-iamguarded-fips | 26.5.6-r4 |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r10 |
| Chainguard | request-9047-keycloak-fips-26.5-iamguarded-fips | 26.5.7-r10 |
| Wolfi | keycloak-26.4 | no fix |
| Wolfi | keycloak-26.4-iamguarded-compat | no fix |
| Wolfi | keycloak-26.5 | 26.5.7-r0 |
| Wolfi | keycloak-26.5-iamguarded-compat | 26.5.7-r0 |