diff --git a/advisories/github-reviewed/2026/03/GHSA-rhgq-f8x5-j2jc/GHSA-rhgq-f8x5-j2jc.json b/advisories/github-reviewed/2026/03/GHSA-rhgq-f8x5-j2jc/GHSA-rhgq-f8x5-j2jc.json index a91088a72aaf5..3e39aa8e232ec 100644 --- a/advisories/github-reviewed/2026/03/GHSA-rhgq-f8x5-j2jc/GHSA-rhgq-f8x5-j2jc.json +++ b/advisories/github-reviewed/2026/03/GHSA-rhgq-f8x5-j2jc/GHSA-rhgq-f8x5-j2jc.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rhgq-f8x5-j2jc", - "modified": "2026-04-13T17:55:01Z", + "modified": "2026-04-13T17:55:02Z", "published": "2026-03-23T12:30:30Z", "aliases": [ "CVE-2026-4633" ], - "summary": "Keycloak's identity-first login flow exposes user information", + "summary": "Keycloak's identity-first login flow exposes user information", "details": "A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.", "severity": [ { @@ -25,17 +25,14 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "26.5.0" + "introduced": "0" }, { - "fixed": "26.6.0" + "fixed": "26.4.12" } ] } - ], - "database_specific": { - "last_known_affected_version_range": "<= 26.5.6" - } + ] }, { "package": { @@ -47,10 +44,10 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "26.5.0" }, { - "last_affected": "26.4.7" + "fixed": "26.6.1" } ] }