Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-19607

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.16-2 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-26 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-26 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.16

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4.16

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6.7-3 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-20 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-20 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6.7

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6.7

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: unaffected

References