CVE-2026-4633: 
Java vulnerability analysis and mitigation

CVE-2026-4633 is a user enumeration vulnerability in Keycloak (Red Hat build of Keycloak) that allows unauthenticated remote attackers to determine whether specific user accounts exist by observing differential error messages during the identity-first login flow when the Organizations feature is enabled. The flaw was reported on March 23, 2026, and publicly disclosed the same day. It affects Red Hat's build of Keycloak (all versions prior to the patch) and carries a CVSS v3.1 base score of 3.7 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). When the Organizations feature and identity-first login flow are both enabled on a Keycloak realm, the application returns distinct error messages depending on whether a submitted username exists: existing users receive "Invalid Password," while non-existent users receive "Invalid username or password." This behavioral difference allows an attacker with network access to the login endpoint to systematically probe for valid usernames without any authentication. Exploitation requires three preconditions: Organizations must be enabled on the realm, the identity-first login flow must be active, and the attacker must have network access to the login endpoint (Red Hat Bugzilla).

Successful exploitation results in information disclosure — specifically, the ability to enumerate valid user accounts within a Keycloak realm. While there is no direct impact on integrity or availability, confirmed username lists can facilitate targeted credential-stuffing, phishing, or brute-force attacks against those accounts, potentially enabling account takeover as a secondary consequence. The confidentiality impact is rated Low, and no privilege escalation or lateral movement is directly achievable through this vulnerability alone (Red Hat CVE, Red Hat Bugzilla).

1. Identify target: Locate a Keycloak instance with Organizations enabled and the identity-first login flow active. This can be done by browsing to /realms/[realm]/account/ and observing the login UI behavior.
2. Prepare username list: Compile a list of candidate usernames (e.g., from OSINT, email format guessing, or leaked data) to test against the target realm.
3. Submit non-existent username: Navigate to /realms/[realm]/account/, enter a username that is unlikely to exist, click "Sign in," enter any password, and submit. Observe the error message: "Invalid username or password."
4. Submit existing username: Repeat the process with a candidate username. If the account exists, the server returns "Invalid Password" instead.
5. Automate enumeration: Script the login attempts (e.g., using curl or a custom tool) to iterate through the username list, recording which usernames trigger the "Invalid Password" response — confirming their existence in the system.
6. Leverage results: Use the confirmed valid usernames for follow-on attacks such as credential stuffing, targeted phishing, or brute-force login attempts (Red Hat Bugzilla).

• Network: High volume of login attempts to /realms/[realm]/account/ or the Keycloak login endpoint from a single IP or small IP range, especially with varied usernames and consistent (arbitrary) passwords.
• Logs: Keycloak access logs showing repeated authentication failures alternating between "Invalid username or password" and "Invalid Password" responses for different usernames from the same source IP; unusual spike in failed login events in a short time window.
• Behavioral: Sequential or alphabetically ordered username submissions in login attempt logs, suggesting automated enumeration rather than organic user activity.

Red Hat has released a patch for the Red Hat build of Keycloak; users should apply the available security update as the primary remediation. The Keycloak 26.6.1 release (and subsequent versions) addresses this issue (Keycloak Release). As interim workarounds if patching is not immediately possible: disable the Organizations feature on affected realms, switch from the identity-first login flow to a standard login flow, or implement rate limiting and IP-based throttling on the login endpoint to reduce the feasibility of automated enumeration (Red Hat Bugzilla).

The vulnerability received routine coverage across CVE aggregation platforms and security feeds shortly after disclosure. A Bluesky post from a CVE tracking account noted the disclosure, and several vulnerability intelligence services (CIRCL, VulDB, INCIBE) indexed the issue. No notable researcher commentary or significant media coverage beyond standard CVE tracking has been observed, consistent with the low severity rating (Red Hat Bugzilla).