A flaw in Keycloak’s identity‑first login flow allows remote actors to send crafted authentication requests. When the Organizations feature is enabled, the server returns different error messages depending on whether the supplied username exists. This differential information release, classified under CWE-209, gives an attacker the ability to enumerate valid user accounts and extract sensitive system information.

The vulnerability impacts the Red Hat Build of Keycloak. No version‑specific details are provided, so any deployment of this product that has Organizations enabled is potentially affected.

The CVSS score of 3.7 indicates low‑moderate severity, while an EPSS of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attacks would require only remote access to the login endpoint and do not need privileged credentials, enabling enumeration of users through special authentication requests.