CVE-2026-19607 — Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via…
Published: 2026-09-16 · CVSS: 5.3 · CVSS 3.1
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7