CVE-2026-4633 — Keycloak: keycloak: user enumeration via differential error messages
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability a…
Published: 2026-03-23 · CVSS: 3.7 · CVSS 3.1
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7