Read the docs
TI-2026-15927 Aliases CVE-2026-19607GHSA-h87q-rx56-87wm

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

Priority LOW 31CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00686 52nd percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Keycloak 26.4—26.4.16-2Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-26Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-26Patch availableCNA
Red HatRed Hat build of Keycloak 26.4.16——Not affectedCNA
Red HatRed Hat build of Keycloak 26.4.16——Not affectedCNA
Red HatRed Hat build of Keycloak 26.6—26.6.7-3Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6-20Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6-20Patch availableCNA
Red HatRed Hat build of Keycloak 26.6.7——Not affectedCNA
Red HatRed Hat build of Keycloak 26.6.7——Not affectedCNA
Red HatRed Hat Single Sign-On 7——Not affectedCNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.16-2 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-26 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-26 Patch available CNA
  • Red Hat build of Keycloak 26.4.16 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.4.16 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6.7-3 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-20 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-20 Patch available CNA
  • Red Hat build of Keycloak 26.6.7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.6.7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:/a:redhat:build_keycloak:26.4::el926.4—Red Hat
cpe:/a:redhat:build_keycloak:26.6::el926.6—Red Hat
cpe:/a:redhat:red_hat_single_sign_on:77—Red Hat
  • cpe:/a:redhat:build_keycloak:26.4::el9 Versions 26.4 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:26.6::el9 Versions 26.6 — ·Red Hat
  • cpe:/a:redhat:red_hat_single_sign_on:7 Versions 7 — ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2026:68276 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.16 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:68277 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.7 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:68280 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.16 Security Update
    • Red Hat build of Keycloak 26.4.16
Show 1 more Red Hat advisories
  • RHSA-2026:68278 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.7 Security Update
    • Red Hat build of Keycloak 26.6.7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Keycloak 26.4Fixed RHSA-2026:68276
Red Hat build of Keycloak 26.4.16Fixed RHSA-2026:68280
Red Hat build of Keycloak 26.6Fixed RHSA-2026:68277
Red Hat build of Keycloak 26.6.7Fixed RHSA-2026:68278
Not affected: 1 product
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19607
  2. 2026-10-03 Alias added: GHSA-h87q-rx56-87wm
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 4

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences