CVE-2026-4633: Red Hat Build Of Keycloak

Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

Affected products

• Red Hat Build Of Keycloak: affected versions not specified

Published 2026-03-23. Last modified 2026-06-17.