Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by redhat

CVE-2026-19607Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

Medium 5.3

In plain English

A medium-severity improper authentication in Red Hat build of Keycloak 26.4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 47.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTSpython-keycloakno fix listedUBUNTU-CVE-2026-19607
Ubuntu:26.10python-keycloakno fix listedUBUNTU-CVE-2026-19607

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4.16 see references
Red Hat Red Hat build of Keycloak 26.4.16 see references
Red Hat Red Hat build of Keycloak 26.6 see references
Red Hat Red Hat build of Keycloak 26.6 see references
Red Hat Red Hat build of Keycloak 26.6 see references
Red Hat Red Hat build of Keycloak 26.6.7 see references
Red Hat Red Hat build of Keycloak 26.6.7 see references
Red Hat Red Hat Single Sign-On 7 see references

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References