Home

Description

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

PUBLISHED Reserved 2026-01-27 | Published 2026-02-09 | Updated 2026-02-10 | Assigner redhat




HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Improperly Implemented Security Check for Standard

Product status

Default status
affected

26.4.9-1 (rpm) before *
unaffected

Default status
affected

26.4-11 (rpm) before *
unaffected

Default status
affected

26.4-10 (rpm) before *
unaffected

Default status
unaffected

Timeline

2026-01-27:Reported to Red Hat.
2026-02-09:Made public.

Credits

Red Hat would like to thank Joy Gilbert Dan and Reynaldo Immanuel for reporting this issue.

References

access.redhat.com/errata/RHSA-2026:2365 (RHSA-2026:2365) vendor-advisory

access.redhat.com/errata/RHSA-2026:2366 (RHSA-2026:2366) vendor-advisory

access.redhat.com/security/cve/CVE-2026-1486 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2433347 (RHBZ#2433347) issue-tracking

cve.org (CVE-2026-1486)

nvd.nist.gov (CVE-2026-1486)

Download JSON