# Possible user enumeration in default username-password form

**URL:** <https://forum.keycloak.org/t/possible-user-enumeration-in-default-username-password-form/29430>\
**Category:** Getting advice\
**Tags:** authentication\
**Created:** [January 17, 2025, 4:43pm UTC](https://forum.keycloak.org/t/possible-user-enumeration-in-default-username-password-form/29430 "2025-01-17T16:43:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonnewell](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jonnewell](https://forum.keycloak.org/u/jonnewell)\
**Post date:** [January 17, 2025, 4:43pm UTC](https://forum.keycloak.org/t/possible-user-enumeration-in-default-username-password-form/29430/1 "2025-01-17T16:43:10Z")

</div>

At first I thought this could be related to my userstorageprovider SPI implementation, but I see this behavior logging into the Master realm:

Enter a valid username and incorrect password:

 ![Screenshot 2025-01-17 at 11.34.12 AM](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/f/f1f6752bad6a2b913e53ddfcc01cdd4d551b39e7.png)

Enter an Invalid username and any password:

 ![Screenshot 2025-01-17 at 11.34.43 AM](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/c/c2d7f25739603de3ad4fc07fd184432f8ea70759.png)

Although the validation message itself does not indicate what part of the credential is invalid, the placement of the message does.

Thanks  
-Jon

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [January 17, 2025, 5:13pm UTC](https://forum.keycloak.org/t/possible-user-enumeration-in-default-username-password-form/29430/2 "2025-01-17T17:13:14Z")

</div>

I am able to reproduce. Good catch.

However, this is a community forum, so the best place to post bugs like that is the [Keycloak GitHub Issues](https://github.com/keycloak/keycloak/issues) page. Once you post it, please post the link of the issue back here so people on the forum can track it.

---

<div class="post-metadata">

**Author:** ![jonnewell](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jonnewell](https://forum.keycloak.org/u/jonnewell)\
**Post date:** [January 17, 2025, 6:40pm UTC](https://forum.keycloak.org/t/possible-user-enumeration-in-default-username-password-form/29430/3 "2025-01-17T18:40:05Z")

</div>

Based on the guidance for issues in github. I should not have made this post itself and I should email the issue to [keycloak-security@googlegroups.com](mailto:keycloak-security@googlegroups.com). I will do so, and then delete this post unless admins have further guidance. Likewise I will not be able to followup with an issue number.