Unauthenticated account lockout via conflicting email registration

Account lockout in Keycloak 23.0.5 allows remote attackers to prevent targeted users from logging in by registering a conflicting email. The self-registration flow accepts a new account whose email equals an existing user's email-format username, causing username authentication to resolve the conflicting identity and deny the original account. Exploitation requires enabled self-registration, a victim whose username and registered email differ, and knowledge of that username; authentication by registered email remains available.