This vulnerability involves the generation of error messages containing sensitive information in the Red Hat Build of Keycloak. Specifically, during the identity-first login flow with Organizations enabled, an attacker can exploit differences in error messages to determine if specific users exist, leading to information disclosure through user enumeration. The CVSS 3.1 base score is 3.7 (low), reflecting that the attack vector is network-based, requires high attack complexity, no privileges or user interaction, and impacts confidentiality only.

The impact is limited to information disclosure through user enumeration, which could aid attackers in gathering valid usernames. There is no impact on integrity or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or fix information is provided in the vendor advisory content, users should monitor Red Hat's official security advisories for updates. Until a fix is available, consider limiting exposure of the affected login flows or implementing additional monitoring for suspicious enumeration attempts.