CVE-2026-4633
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Mar 23, 2026
Vendor
unknown
Description
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.