Dashboard / CVE-2026-4633

CVE-2026-4633

LOW
INFO Priority: 0.02 BB Relevance: 57/100
Published: 2026-03-23 Modified: 2026-10-22 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: None

Description

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
redhat build_of_keycloak -

References & Advisories (3)

https://bugzilla.redhat.com/show_bug.cgi?id=2450247
Exploit Issue Tracking Vendor Advisory

Bug Bounty Relevance

57 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

3.7 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — Exploitation Probability

0.42%
Raw Score 0.004220
Percentile 36.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00422
2026-10-28
0.00422

Intelligence Sources

nvd ref →

External Links