REDHAT-BUG-2514529: Medium severity maven/org.keycloak/keycloak-services vulnerability
A flaw was found in the Keycloak first-broker-login flow within the keycloak-services Maven artifact. The vulnerability exists because the flow does not sufficiently validate or prevent a brokered identity from colliding with an existing local user's username when loginWithEmail is enabled and usernames are email-shaped. An unauthenticated remote attacker can register an account on a configured external Identity Provider using an email address that matches a victim's Keycloak username. By performing a broker login with this account, the attacker creates a username collision state. This state causes all subsequent authentication attempts by the legitimate victim to fail, effectively locking them out of their account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Keycloak first-broker-login flow with a configured external Identity Provider are affected when loginWithEmail is enabled and local usernames are email-shaped.
What does an attacker need to do to trigger the lockout?
An unauthenticated remote attacker needs to register an account with the external Identity Provider using an email address that matches a victim's Keycloak username, then complete a broker login with that account.
What is the practical impact on the targeted user?
The broker login creates a username-collision state that causes subsequent authentication attempts by the legitimate user to fail, locking that user out of their account.