CVE-2026-4633 Keycloak: keycloak: user enumeration via differential error messages

What is CVE-2026-4633?

CVE-2026-4633 is a low-severity vulnerability in Redhat Build of Keycloak, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

Weakness: CWE-209

Which versions are affected by CVE-2026-4633?

4 open source packages ship an affected version, including org.keycloak:keycloak-services. It affects 1 product.

Products include Redhat Build of Keycloak.

How do I fix CVE-2026-4633?

Upgrade org.keycloak:keycloak-services to a fixed version for your release line: 26.4.12 or 26.6.1.

Is CVE-2026-4633 being exploited?

There is no known exploitation of CVE-2026-4633 in the wild and no public exploit code.

Other vulnerabilities in Redhat Build of Keycloak

• CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation High 8.8
• CVE-2026-3047 Keycloak SAML Broken has Authentication Bypass by Primary Weakness High 8.8
• CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher High 8.1
• CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers High 8.1
• CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users High 8.1

All Redhat Build of Keycloak vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ECHO-6bb9-68c2-ffad, GHSA-rhgq-f8x5-j2jc, MINI-8wv9-wr6p-42xp, MINI-mjmw-589j-jgrw.