Vulnerability · Published Sep 16, 2026 · Assigned by redhat
CVE-2026-19607Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
Medium 5.3
In plain English
A medium-severity improper authentication in Red Hat build of Keycloak 26.4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | python-keycloak | no fix listed | UBUNTU-CVE-2026-19607 |
| Ubuntu:26.10 | python-keycloak | no fix listed | UBUNTU-CVE-2026-19607 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4.16 | see references |
| Red Hat | Red Hat build of Keycloak 26.4.16 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6.7 | see references |
| Red Hat | Red Hat build of Keycloak 26.6.7 | see references |
| Red Hat | Red Hat Single Sign-On 7 | see references |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- RHSA-2026:68276 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68277 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68278 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68280 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-19607 vdb-entry, x_refsource_REDHAT
- RHBZ#2514529 issue-tracking, x_refsource_REDHAT