The vulnerability exists in the first-broker-login flow of the keycloak-services component, which handles initial authentication and account linking when users log in via external identity providers. An attacker can exploit this by registering a username on an external provider that matches a legitimate user's username, triggering a collision in Keycloak. This collision causes the legitimate user to be locked out of their account. The issue is tracked as CVE-2026-19607 with a CVSS 3.1 base score of 5.3 (medium severity). Red Hat has released security updates in Keycloak versions 26.4.16 and 26.6.7 that fix this vulnerability.

The vulnerability can cause denial of service to legitimate users by locking them out of their accounts due to username collisions triggered by an attacker registering matching usernames on external identity providers. There is no direct confidentiality or integrity impact reported. The impact is limited to availability of user accounts.

Red Hat has released updated Keycloak container images versions 26.4.16 and 26.6.7 that include a fix for this vulnerability. Users should apply these updates to their Red Hat build of Keycloak deployments. Before updating, it is recommended to back up existing installations, including applications, configuration files, and databases. No other mitigation or workaround is indicated in the vendor advisories.