# CVE-2026-3009: Keycloak authentication bypass via disabled Identity Provider

Source: https://junglewise.ai/threats/cve-2026-3009-keycloak-authentication-bypass-via-disabled-identity-provider  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-3009 · Severity: high · CVSS 8.1 · Published 2026-03-05

A security flaw in Keycloak, a popular identity and access management tool, allows users to log in through external providers even after an administrator has disabled them. By reusing a specific type of login request, an attacker can bypass these administrative restrictions to gain unauthorized access to protected applications. This could lead to unauthorized account access if an organization relies on disabling specific login methods to revoke access.

Technologies: [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services), [Redhat Jboss Enterprise Application Platform](https://junglewise.ai/threats/technologies/jboss-enterprise-application-platform), [Redhat Jboss Enterprise Application Platform Expansion Pack](https://junglewise.ai/threats/technologies/jboss-enterprise-application-platform-expansion-pack), [Redhat Single Sign-On](https://junglewise.ai/threats/technologies/single-sign-on). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-3009 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3009 being exploited in the wild.

**How severe is CVE-2026-3009?** High severity, with a CVSS score of 8.1, published 5 March 2026.

**Which products and versions are affected?** org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,fixed=26.5.5.

**Is there a fix for CVE-2026-3009?** Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3009 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3009?** Check whether you run org.keycloak:keycloak-services (Maven), Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.keycloak:keycloak-services (Maven): upgrade to 26.5.5 or later

  ```sh
  # set org.keycloak:keycloak-services to 26.5.5 in your pom.xml or build.gradle
  ```


## Technical details

An authentication bypass vulnerability exists in Keycloak's IdentityBrokerService.performLogin endpoint due to improper enforcement of disabled Identity Providers (IdP). The root cause is a failure to validate the 'enabled' status of an IdP when processing a reused, previously generated login request. An unauthenticated remote attacker who knows the target IdP alias can bypass administrative restrictions to authenticate via a provider that should be inactive. This issue affects Red Hat build of Keycloak and Red Hat Single Sign-On; fixes are available in Keycloak version 26.4.10 and associated Red Hat errata (RHSA-2026:3947).

## Affected products

- Red Hat build of Keycloak 26.4.10-1
- Red Hat Single Sign-On 7 7

## Identifiers

- CVE-2026-3009
- GHSA-m297-3jv9-m927

## Timeline

- 2026-03-05: disclosed
- 2026-03-05: patched

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)
- [https://access.redhat.com/errata/RHSA-2026:3947](https://access.redhat.com/errata/RHSA-2026:3947)
- [https://access.redhat.com/errata/RHSA-2026:3948](https://access.redhat.com/errata/RHSA-2026:3948)
- [https://access.redhat.com/security/cve/CVE-2026-3009](https://access.redhat.com/security/cve/CVE-2026-3009)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2441867](https://bugzilla.redhat.com/show_bug.cgi?id=2441867)

## Related threats

- [Keycloak unauthenticated account takeover via reset-credentials bypass](https://junglewise.ai/threats/cve-2026-18963-siemens-industrial-edge-management-authentication-bypass-in)
- [Duplicate Advisory: Authentication bypass via jwt algorithm confusion](https://junglewise.ai/threats/duplicate-advisory-authentication-bypass-via-jwt-algorithm-confusion-40489dee)
- [Keycloak JWT algorithm confusion in JWT Authorization Grant flow](https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow)
- [Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison](https://junglewise.ai/threats/duplicate-advisory-keycloak-vulnerable-to-authorization-bypass-via-009d6a49)
- [Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass](https://junglewise.ai/threats/duplicate-advisory-keycloak-vulnerable-to-cross-site-scripting-xss-via-1687acae)