A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 6
https://access.redhat.com/errata/RHSA-2026:68276
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:68277
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:68278
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:68280
secalert@redhat.com
https://access.redhat.com/security/cve/CVE-2026-19607
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2514529
secalert@redhat.com