CVE-2026-3009
Authentication Bypass in Keycloak IdentityBrokerService via Disabled IdP
Publication date: 2026-03-05
Last updated on: 2026-03-24
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | single_sign-on | 7.0 |
| redhat | jboss_enterprise_application_platform_expansion_pack | * |
| redhat | build_of_keycloak | * |
| redhat | jboss_enterprise_application_platform | 8.0 |
| redhat | build_of_keycloak | 26.4 |
| redhat | build_of_keycloak | 26.4.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the IdentityBrokerService.performLogin endpoint of Keycloak. It allows authentication to proceed using an Identity Provider (IdP) even after the IdP has been disabled by an administrator.
An attacker who knows the IdP alias can reuse a previously generated login request or manually invoke the broker login URL with valid session parameters. This causes the authentication flow to continue and redirect the user to the external provider despite the IdP being administratively disabled.
As a result, this flaw bypasses administrative access control restrictions and allows unauthorized authentication through a disabled external provider.
How can this vulnerability impact me? :
This vulnerability can have a significant impact by undermining access control enforcement in Keycloak.
An attacker can authenticate through an Identity Provider that has been disabled by an administrator, potentially gaining unauthorized access to systems or data.
Since the vulnerability can be exploited remotely without any privileges, it poses a high security risk, especially in environments relying on Keycloak for authentication.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves monitoring for unauthorized authentication attempts through disabled Identity Providers (IdPs) in Keycloak. Since the vulnerability allows authentication via the broker login URL even after an IdP is disabled, you can look for unusual or unexpected access to the endpoint /realms/{realm}/broker/{alias}/login.'}, {'type': 'paragraph', 'content': 'Specifically, you can check your Keycloak server logs for requests to the broker login endpoint corresponding to disabled IdPs. Look for repeated or suspicious login attempts using known IdP aliases that should be disabled.'}, {'type': 'paragraph', 'content': 'While no explicit commands are provided in the resources, you can use network monitoring tools or log analysis commands such as:'}, {'type': 'list_item', 'content': 'Using grep to find broker login attempts in Keycloak logs: grep "/broker/" /path/to/keycloak/logs/server.log'}, {'type': 'list_item', 'content': 'Filter for disabled IdP aliases in the logs by combining grep with the alias name: grep "/broker/{alias}/login" /path/to/keycloak/logs/server.log'}, {'type': 'list_item', 'content': 'Use network monitoring tools like tcpdump or Wireshark to capture HTTP requests to the broker login URL and analyze for unauthorized access.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that disabled Identity Providers (IdPs) cannot be used to authenticate users through the broker login endpoint.
Since the vulnerability arises because the broker login endpoint does not re-validate the enabled/disabled status of an IdP during login processing, you should:
- Apply any available security patches or updates from Keycloak or your vendor that address this specific issue.
- Temporarily disable or restrict access to the broker login endpoint (/realms/{realm}/broker/{alias}/login) until a patch is applied.
- Review and audit all IdP configurations to ensure that only necessary providers are enabled.
- Monitor authentication logs closely for any suspicious activity involving disabled IdPs.