Detections
Analytics
CVE-2026-4633
low
Description
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
References
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14400
https://bugzilla.redhat.com/show_bug.cgi?id=2450247