BIT-keycloak-2026-3009

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-3009.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-keycloak-2026-3009

Aliases

CVE-2026-3009
GHSA-m297-3jv9-m927

Published

2026-08-25T11:42:13Z

Modified

2026-09-10T16:01:40Z

Summary

Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

Details

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

Database specific

{
    "cpes": [
        "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:text-only:*:*:*",
        "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / keycloak

Package

Name: keycloak
Purl: pkg:bitnami/keycloak

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

26.4.0

Fixed

26.4.1

Introduced

26.4.10

Fixed

26.5.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-3009.json"