Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-3009US | high8.1 | — | ||
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:3947WEB
- https://access.redhat.com/errata/RHSA-2026:3948WEB
- https://access.redhat.com/security/cve/CVE-2026-3009WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2441867WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://github.com/keycloak/keycloak/commit/4fd5367e6cc28cfa68fb2240fc459c12b1fdbf2aWEB
- https://github.com/keycloak/keycloak/issues/46911WEB
- https://github.com/keycloak/keycloak/releases/tag/26.5.5WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan