# CVE-2026-1486: Keycloak improper security check for disabled Identity Providers

Source: https://junglewise.ai/threats/cve-2026-1486-keycloak-improper-security-check-for-disabled-identity-providers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-09. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-1486 · Severity: high · CVSS 8.8 · Published 2026-02-09

Keycloak, a popular identity and access management solution, contains a flaw where it continues to trust external identity providers even after they have been disabled by an administrator. This means that if a partner organization or login service is removed due to a security breach or offboarding, an attacker with access to that service's credentials could still log into your systems. This could lead to unauthorized access to sensitive data and applications despite administrative attempts to block the connection.

Technologies: [Keycloak](https://junglewise.ai/threats/technologies/keycloak), [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services), [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak). Vendors: [Keycloak](https://junglewise.ai/threats/vendors/keycloak), [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-1486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1486 being exploited in the wild.

**How severe is CVE-2026-1486?** High severity, with a CVSS score of 8.8, published 9 February 2026.

**Which products and versions are affected?** Keycloak 26.4.0 through 26.4.8; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=26.5.0,fixed=26.5.3; Red Hat build of Keycloak 26.4.0 through 26.4.8.

**Is there a fix for CVE-2026-1486?** Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1486 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-1486?** Check whether you run Keycloak, org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.keycloak:keycloak-services (Maven): upgrade to 26.5.3 or later

  ```sh
  # set org.keycloak:keycloak-services to 26.5.3 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in the Keycloak jwt-authorization-grant flow due to an improper security check in the issuer lookup mechanism. The 'lookupIdentityProviderFromIssuer' function retrieves IdP configurations but fails to filter for the 'isEnabled=false' status. Consequently, if an administrator disables an IdP (e.g., following a compromise), an attacker possessing that IdP's signing key can still generate valid JWT assertions. Keycloak will accept these assertions and issue valid access tokens, bypassing the intended administrative lockout. The issue is addressed in Red Hat build of Keycloak 26.4.9.

## Affected products

- Red Hat build of Keycloak 26.4.0 through 26.4.8
- Keycloak Keycloak versions prior to 26.4.9

## Identifiers

- CVE-2026-1486
- GHSA-37gf-gmxv-74wv

## Timeline

- 2026-01-27: disclosed: Initial report in Red Hat Bugzilla
- 2026-02-09: advisory: Red Hat published security advisory RHSA-2026:2365
- 2026-02-09: patched: Fixed in Red Hat build of Keycloak 26.4.9

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:2365](https://access.redhat.com/errata/RHSA-2026:2365)
- [https://access.redhat.com/errata/RHSA-2026:2366](https://access.redhat.com/errata/RHSA-2026:2366)
- [https://access.redhat.com/security/cve/CVE-2026-1486](https://access.redhat.com/security/cve/CVE-2026-1486)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2433347](https://bugzilla.redhat.com/show_bug.cgi?id=2433347)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1486.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1486.json)

## Related threats

- [Keycloak login-failure storage synchronization error in MySQL/MariaDB](https://junglewise.ai/threats/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of)
- [Keycloak PKCE bypass in login after password reset](https://junglewise.ai/threats/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak)
- [Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management)
- [Keycloak token sanitization bypass in protocol mapper](https://junglewise.ai/threats/cve-2026-97848-a-flaw-was-found-in-the-token-sanitization-logic-of-keycloak-an)
- [Keycloak Dynamic Client Registration privilege escalation](https://junglewise.ai/threats/cve-2026-96547-a-flaw-was-found-in-the-dynamic-client-registration-component-of)