Authentication Bypass Vulnerability in Keycloak Services by Red Hat

CVE-2026-19607

What is CVE-2026-19607?

A vulnerability in the keycloak-services component during the first-broker-login flow has been identified, where an attacker could exploit the authentication process involving external identity providers. By registering a username matching an existing one, an attacker could cause a collision within Keycloak, which would result in the legitimate user being inadvertently locked out of their account. This flaw underscores the importance of securing the authentication processes to prevent unauthorized account access and ensure user availability.

References