CVE-2026-19607: Keycloak Auth Bypass Vulnerability

CVE-2026-19607 Overview

CVE-2026-19607 is an authentication flaw in the first-broker-login flow of the keycloak-services component. The component handles initial authentication and account linking when a user signs in through an external identity provider (IdP). An attacker can register a username on an external provider that matches an existing Keycloak account, triggering a collision during the broker login process. The collision locks the legitimate user out of their own account. The issue is categorized under [CWE-287] Improper Authentication and affects Red Hat build of Keycloak deployments referenced in the associated advisories.

Critical Impact
Attackers can lock legitimate users out of their Keycloak accounts by registering colliding usernames on federated identity providers, disrupting access to any application relying on Keycloak for single sign-on.

Affected Products

Red Hat build of Keycloak (see RHSA-2026:68276)
Red Hat build of Keycloak (see RHSA-2026:68277)
Red Hat build of Keycloak (see RHSA-2026:68278 and RHSA-2026:68280)

Discovery Timeline

2026-09-16 - CVE-2026-19607 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19607

Vulnerability Analysis

The flaw resides in Keycloak's first-broker-login authentication flow, which runs the first time a federated user authenticates through an external identity provider. During this flow, Keycloak attempts to match the incoming external identity to an existing local account based on attributes such as username or email. The matching logic does not adequately distinguish between a legitimate account owner and an unrelated third party who happens to control a matching username on an external IdP. As a result, an attacker who registers a colliding username on a trusted upstream provider can interfere with the account linking process. The impact is limited to availability, since the attacker cannot read data or take over the account, but the legitimate user cannot complete authentication.

Root Cause

The root cause is improper authentication handling ([CWE-287]) during external identity linking. The keycloak-services component treats a username match from an external provider as sufficient signal to initiate account linking without adequately validating that the requesting identity has any relationship to the existing local account. This design assumption breaks in environments where external IdP usernames are attacker-controllable.

Attack Vector

Exploitation requires no authentication to Keycloak and no user interaction from the victim. An attacker enumerates or guesses a target username in the Keycloak realm, then registers the same username on an external identity provider that the realm trusts for federation. When the attacker initiates the first-broker-login flow, Keycloak detects the username collision and enters a state that blocks the legitimate user from completing subsequent logins. The attack is conducted over the network against the Keycloak authentication endpoints.

No public proof-of-concept code is available. See the Red Hat CVE summary and Red Hat Bug Report #2514529 for vendor technical details.

Detection Methods for CVE-2026-19607

Indicators of Compromise

Repeated first-broker-login events from an external IdP for usernames that already exist as local Keycloak accounts.
Authentication failures or lockout events for legitimate users immediately following a broker login attempt referencing the same username.
Unexpected account linking prompts or duplicate-username error events in Keycloak server logs.

Detection Strategies

Correlate Keycloak IDENTITY_PROVIDER_FIRST_LOGIN and IDENTITY_PROVIDER_LINK_ACCOUNT audit events with subsequent LOGIN_ERROR events for the same username.
Alert on brokered logins that originate from newly created accounts on upstream identity providers when the username matches an existing internal account.
Baseline the normal ratio of first-broker-login events to successful linkings and flag anomalous spikes per realm.

Monitoring Recommendations

Forward Keycloak admin and login event logs to a centralized SIEM or data lake for correlation across realms and IdPs.
Enable Keycloak event listeners in JSON format and retain them long enough to reconstruct account-linking sequences.
Monitor helpdesk and identity support tickets for clusters of user-reported lockouts tied to federated login.

How to Mitigate CVE-2026-19607

Immediate Actions Required

Apply the Red Hat build of Keycloak updates referenced in RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280.
Inventory all Keycloak realms that permit first-broker-login with external identity providers and prioritize patching those exposed to public IdPs.
Review recent authentication logs for evidence of exploitation against high-value accounts.

Patch Information

Red Hat has published fixed packages through the errata listed above. Refer to the Red Hat CVE summary for CVE-2026-19607 for the authoritative list of fixed versions and package channels. Upstream Keycloak users should track the corresponding upstream release notes and apply the equivalent update.

Workarounds

Configure the first-broker-login flow to require additional verification steps, such as email confirmation or existing-account re-authentication, before linking a brokered identity to a local account.
Restrict which external identity providers are trusted for automatic account linking, particularly public providers where attackers can freely register usernames.
Disable automatic username-based matching and require deterministic identifiers, such as verified email addresses issued only by trusted providers, for account linking.

bash

# Configuration example: harden the first-broker-login flow using kcadm
# Require the user to confirm account linking via existing credentials or email
kcadm.sh update authentication/flows/first-broker-login/executions \
  -r <realm> \
  -b '{"provider":"idp-confirm-link","requirement":"REQUIRED"}'

kcadm.sh update authentication/flows/first-broker-login/executions \
  -r <realm> \
  -b '{"provider":"idp-email-verification","requirement":"REQUIRED"}'