Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
I hacked Keycloak again! :D Discovery: CVE-2026-19607 Details: Username Takeover in Keycloak (a very widely used IAM, managed by Redhat) leading to Unauthenticated Account lock-out. Exploit: https://7ragnarok7.github.io/CVE-2026-19607/ #security #cybersecurity #cve #hack #7Ragnarok7 #keycloak