CVE-2026-1486
Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant
- State
- Published
- Severity
- 8.8 High
- Published
- Feb 9, 2026
- Updated
- Jul 15, 2026
- Reserved
- Jan 27, 2026
Description
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | redhat |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | redhat-SADP |
Weaknesses
- CWE-358 Improperly Implemented Security Check for Standard
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.9Red Hat |
References
- RHSA-2026:2365vendor-advisory
- RHSA-2026:2366vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-1486vdb-entry
- RHBZ#2433347issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1486.json
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.