CVE-2026-3009
published 2026-03-05CVE-2026-3009: A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it…
PriorityP352high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.33%
25.7th percentile
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | — | — |
| redhat | build_of_keycloak | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | single_sign-on | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
ghsa·2026-03-05
CVE-2026-3009 [HIGH] CWE-285 Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
OSV
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
osv·2026-03-05
CVE-2026-3009 [HIGH] Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
Red Hat
org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)
vendor_redhat·2026-03-05·CVSS 8.1
CVE-2026-3009 [HIGH] CWE-863 org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)
org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2026:3947https://access.redhat.com/errata/RHSA-2026:3948https://access.redhat.com/security/cve/CVE-2026-3009https://bugzilla.redhat.com/show_bug.cgi?id=2441867https://access.redhat.com/errata/RHSA-2026:3947https://access.redhat.com/errata/RHSA-2026:3948https://access.redhat.com/security/cve/CVE-2026-3009https://bugzilla.redhat.com/show_bug.cgi?id=2441867https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3009.json
2026-03-05
Published