Prevent User Enumeration in Hybrid Login Flow by Proceeding to the Next Step #37776

KlajdBakalli · 2025-03-03T10:58:50Z

KlajdBakalli
Mar 3, 2025

Description:
Current Process in Keycloak Hybrid Browser Login Flow:

The user enters an email or username on the login screen.
If the email/username exists, the system proceeds to the next step.
If the email/username does not exist, Keycloak stays on the same screen and displays an error message: "Invalid username or email."

Problem
Since Keycloak does not proceed to the next step for non-existent users, attackers can systematically test usernames to identify valid accounts. This can be exploited for unauthorized access attempts and security threats.

Proposed Fix

Always proceed to the next step, regardless of whether the username exists.
If the user does not exist, fail later.

This ensures a consistent login experience for all users, eliminating user enumeration risks.
Looking forward to thoughts and suggestions on this approach..

References:

Keycloak Issue #17629

Navigation Menu

Repository navigation

Prevent User Enumeration in Hybrid Login Flow by Proceeding to the Next Step #37776

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Prevent User Enumeration in Hybrid Login Flow by Proceeding to the Next Step #37776

Uh oh!

Uh oh!

KlajdBakalli Mar 3, 2025

Replies: 0 comments

KlajdBakalli
Mar 3, 2025