# CVE-2026-4633: Keycloak user enumeration in identity-first login flow

Source: https://junglewise.ai/threats/cve-2026-4633-keycloak-user-enumeration-in-identity-first-login-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-23. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-4633 · Severity: low · CVSS 3.7 · Published 2026-03-23

Keycloak, an open-source identity and access management solution, is vulnerable to a user enumeration flaw when the Organizations feature is enabled. An attacker can use subtle differences in error messages during the login process to confirm whether specific usernames exist in the system. This information can be used to facilitate more targeted attacks, such as password guessing or phishing.

Technologies: [Keycloak](https://junglewise.ai/threats/technologies/keycloak), [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services), [Redhat Build Of Keycloak](https://junglewise.ai/threats/technologies/redhat-build-of-keycloak). Vendors: [Keycloak](https://junglewise.ai/threats/vendors/keycloak), [Maven](https://junglewise.ai/threats/vendors/maven), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-4633 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4633 being exploited in the wild.

**How severe is CVE-2026-4633?** Low severity, with a CVSS score of 3.7, published 23 March 2026.

**Which products and versions are affected?** Keycloak >= 26.5.0, < 26.6.1; < 26.4.12, >= 26.5.0, <= 26.5.6; <= 26.4.7; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=26.5.0,fixed=26.6.1.

**Is there a fix for CVE-2026-4633?** Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4633 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-4633?** Check whether you run Keycloak, org.keycloak:keycloak-services (Maven) or Redhat Build Of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.keycloak:keycloak-services (Maven): upgrade to 26.6.1 or later

  ```sh
  # set org.keycloak:keycloak-services to 26.6.1 in your pom.xml or build.gradle
  ```


## Technical details

A flaw exists in Keycloak's identity-first login flow (CWE-209) when the Organizations feature is active. By observing differential error messages returned by the server, a remote, unauthenticated attacker can determine if a specific user exists within the system. The attack complexity is considered high as it requires specific configuration (Organizations enabled) and precise analysis of server responses. This vulnerability allows for user enumeration, which can be a precursor to brute-force or social engineering attacks. Patches are available in versions 26.4.12 and 26.6.1.

## Affected products

- Keycloak Keycloak >= 26.5.0, < 26.6.1; < 26.4.12

## Identifiers

- CVE-2026-4633
- GHSA-rhgq-f8x5-j2jc

## Timeline

- 2026-03-23: disclosed
- 2026-03-23: advisory

## References

- [https://api.github.com/users/dnegreira](https://api.github.com/users/dnegreira)
- [https://github.com/dnegreira](https://github.com/dnegreira)
- [https://api.github.com/users/dnegreira/gists%7B/gist_id%7D](https://api.github.com/users/dnegreira/gists%7B/gist_id%7D)
- [https://api.github.com/users/dnegreira/repos](https://api.github.com/users/dnegreira/repos)
- [https://avatars.githubusercontent.com/u/5215383?v=4](https://avatars.githubusercontent.com/u/5215383?v=4)
- [https://api.github.com/users/dnegreira/events%7B/privacy%7D](https://api.github.com/users/dnegreira/events%7B/privacy%7D)

## Related threats

- [Keycloak login-failure storage synchronization error in MySQL/MariaDB](https://junglewise.ai/threats/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of)
- [Keycloak PKCE bypass in login after password reset](https://junglewise.ai/threats/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak)
- [Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management)
- [Keycloak token sanitization bypass in protocol mapper](https://junglewise.ai/threats/cve-2026-97848-a-flaw-was-found-in-the-token-sanitization-logic-of-keycloak-an)
- [Keycloak Dynamic Client Registration privilege escalation](https://junglewise.ai/threats/cve-2026-96547-a-flaw-was-found-in-the-dynamic-client-registration-component-of)