CVE-2026-4633

LowCVSS 3.7/10Last modified Oct 22, 2026

Description

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
Red Hat	Red Hat build of Keycloak 26.4.12	—
Red Hat	Red Hat Build of Keycloak	—

References

https://access.redhat.com/errata/RHSA-2026:19596
https://access.redhat.com/security/cve/CVE-2026-4633Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450247Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Mar 23, 2026
Last modified: Oct 22, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-463307.8In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd42 CVE-2026-463317.8In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_CVE-2026-463328.0In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352_boot CVE-2026-463337.1In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a t CVE-2026-463348.7OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vul CVE-2026-463367.1Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.CVE-2026-463375.3WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywher CVE-2026-463384.3PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a stri CVE-2026-4633910.09Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api CVE-2026-46347.5A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an CVE-2026-463407.5Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.1 CVE-2026-463416.1The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on