CVE-2026-3009
Severity
8.1HIGH
EPSS
0.0%
top 90.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 5
Description
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2
Affected Packages4 packages
🔴Vulnerability Details
3GHSA▶
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator↗2026-03-05
OSV▶
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator↗2026-03-05
CVEList▶
Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)↗2026-03-05
📋Vendor Advisories
1Red Hat▶
org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)↗2026-03-05