Report: CVE-2026-4633 - Keycloak: keycloak: user enumeration via differential error messages

Report: CVE-2026-4633 - Keycloak: keycloak: user enumeration via differential error messages

CVE ID :CVE-2026-4633 Published : March 23, 2026, 11:16 a.m. | 22 minutes ago Description :A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE Details

Severity
LOW
Published
March 23, 2026
Impact: information disclosure