CVE-2026-19607: Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-16
Weakness: CWE-287

Description

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

Affected products

Red Hat build of Keycloak 26.4: all versions — fixed in 26.4-26, 26.4.16-2, 26.6-20, 26.6.7-3

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4-26, 26.4.16-2, 26.6-20, 26.6.7-3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-19607 or the next vulnerability affects your stack