CVE-2026-3009
8.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Exploitability: 2.8 / Impact: 5.2
Source: NVD
Description
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
Affected (6)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| All versions | |
| Version 8.0 | |
| All versions | |
| Version 7.0 |
Related CWEs
CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References (9)
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Vendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Issue TrackingVendor Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Timeline
No history available yet.