CVE-2026-4633: Keycloak: keycloak: user enumeration via differential error messages
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
Other sources
User enumeration via differential error messages in Organizations + identity-first login flow. Existing users receive "Invalid Password" while non-existent users receive "Invalid username or password." Requirements to exploit: Organizations enabled on realm, identity-first login flow active, network access to login endpoint.
Steps to reproduce:
1. Create a realm and enable Organizations. 2. Create an organization and add a user with a known password. 3. Navigate to /realms/[realm]/account/. 4. Enter a non-existent username, click "Sign in," enter any password, and submit. 5. Observe error: "Invalid username or password." 6. Repeat with an existing username. 7. Observe error: "Invalid Password." 8. The differential response confirms user existence.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4633?
CVE-2026-4633 has a moderate severity rating due to its potential for user enumeration through error messages.
How do I fix CVE-2026-4633?
To mitigate CVE-2026-4633, update Keycloak to the latest version where this flaw has been patched.
Who is affected by CVE-2026-4633?
CVE-2026-4633 affects installations of Red Hat Keycloak where Organizations feature is enabled.
What type of vulnerability is CVE-2026-4633?
CVE-2026-4633 is a user enumeration vulnerability that arises from differential error messages during the login process.
Can CVE-2026-4633 be exploited remotely?
Yes, CVE-2026-4633 can be exploited remotely by attackers to determine the existence of users in Keycloak.