CVE-2026-4633Low· 3.7▾ SunlitKeycloak's identity-first login flow exposes user information
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
Last analysed / modified upstream
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
org.keycloak:keycloak-services >= 26.5.0, < 26.6.1org.keycloak:keycloak-services < 26.4.12Upgrade to a patched release:
org.keycloak:keycloak-services 26.6.1org.keycloak:keycloak-services 26.4.12Connected by shared product, vendor, weakness, or advisory.
CVE-2026-37980Medium· 6.9Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
CVE-2026-4628Medium· 4.3Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
CVE-2026-9795High· 7.3Keycloak has privilege escalation via improper scope mapping enforcement
CVE-2026-106123Medium· 5.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
GHSA-wmxr-6j5f-838pHigh· 7.7Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
CVE-2026-90997High· 7.4A flaw was found in Keycloak