CVE-2026-19607

Name of the Vulnerable Software and Affected Versions keycloak-services (affected versions not specified)

Description A flaw exists in the first-broker-login flow of the keycloak-services component, which manages initial authentication and account linking for users logging in via external identity providers. An attacker can register a username on an external provider that matches an existing user to trigger a collision, causing the legitimate user to be locked out of their account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.