CVE-2026-19607: Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
Other sources
A flaw was found in the Keycloak first-broker-login flow within the keycloak-services Maven artifact. The vulnerability exists because the flow does not sufficiently validate or prevent a brokered identity from colliding with an existing local user's username when loginWithEmail is enabled and usernames are email-shaped. An unauthenticated remote attacker can register an account on a configured external Identity Provider using an email address that matches a victim's Keycloak username. By performing a broker login with this account, the attacker creates a username collision state. This state causes all subsequent authentication attempts by the legitimate victim to fail, effectively locking them out of their account.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which Keycloak configurations are affected?
Affected deployments use a configured external identity provider, have loginWithEmail enabled, and use usernames in an email-shaped format. The issue occurs during the first-broker-login and account-linking flow.
What does an attacker need to exploit this issue?
The attacker does not need to authenticate to Keycloak. They need to register an account with the configured external identity provider using an email address that matches a victim's Keycloak username, then perform a broker login.
What is the practical impact on a targeted user?
A successful broker login creates a username-collision state. Subsequent authentication attempts by the legitimate user fail, locking that user out of their account.