CVE-2026-4633CWE-209

CVE-2026-4633

Low · published March 23, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-03-23T15:16Z
Affected products (1)
ProductVersionsFixed in
redhat/build_of_keycloakall versions—
References (3)
https://access.redhat.com/errata/RHSA-2026:19596 · [email protected]https://access.redhat.com/security/cve/CVE-2026-4633 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2450247 · [email protected]
EPSS history
Timeline
  • 23 MAR 10:53Z
    Keycloak: keycloak: user enumeration via differential error messages
    cvelistv5