CVE-2026-3009: Keycloak authentication bypass via disabled Identity Provider

CVE-2026-3009 · Severity: high · CVSS 8.1 · Published 2026-03-05

A security flaw in Keycloak, a popular identity and access management tool, allows users to log in through external providers even after an administrator has disabled them. By reusing a specific type of login request, an attacker can bypass these administrative restrictions to gain unauthorized access to protected applications. This could lead to unauthorized account access if an organization relies on disabling specific login methods to revoke access.

Technologies: org.keycloak:keycloak-services (Maven), Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack, Redhat Single Sign-On. Vendors: Maven, Redhat.

Quick answers

Is CVE-2026-3009 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3009 being exploited in the wild.
How severe is CVE-2026-3009?
High severity, with a CVSS score of 8.1, published 5 March 2026.
Which products and versions are affected?
org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,fixed=26.5.5.
Is there a fix for CVE-2026-3009?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3009 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-3009?
Check whether you run org.keycloak:keycloak-services (Maven), Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.5.5 or later
    # set org.keycloak:keycloak-services to 26.5.5 in your pom.xml or build.gradle

Technical details

An authentication bypass vulnerability exists in Keycloak's IdentityBrokerService.performLogin endpoint due to improper enforcement of disabled Identity Providers (IdP). The root cause is a failure to validate the 'enabled' status of an IdP when processing a reused, previously generated login request. An unauthenticated remote attacker who knows the target IdP alias can bypass administrative restrictions to authenticate via a provider that should be inactive. This issue affects Red Hat build of Keycloak and Red Hat Single Sign-On; fixes are available in Keycloak version 26.4.10 and associated Red Hat errata (RHSA-2026:3947).

Affected products

  • Red Hat build of Keycloak 26.4.10-1
  • Red Hat Single Sign-On 7 7

Identifiers

  • CVE-2026-3009
  • GHSA-m297-3jv9-m927

Timeline

  • 2026-03-05: disclosed
  • 2026-03-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.