CVE-2026-3009

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:3947	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3948	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-3009	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2441867	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:build_of_keycloak:-::::text-only:::
	cpe:2.3:a:redhat:build_of_keycloak:26.4:::::::*
	cpe:2.3:a:redhat:build_of_keycloak:26.4.10:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:::::::*
	cpe:2.3:a:redhat:single_sign-on:7.0:::::::*

History

No history.

Information

Published : 2026-03-05 19:16

Updated : 2026-03-24 12:16

NVD link : CVE-2026-3009

Mitre link : CVE-2026-3009

CVE.ORG link : CVE-2026-3009

JSON object : View

Products Affected

redhat

jboss_enterprise_application_platform_expansion_pack
build_of_keycloak
single_sign-on
jboss_enterprise_application_platform

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-3009", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2026-03-05T19:16:18.193", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:3947", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:3948", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-3009", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441867", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider."}, {"lang": "es", "value": "Una falla de seguridad en el endpoint IdentityBrokerService.performLogin de Keycloak permite que la autenticaci\u00f3n proceda usando un Proveedor de Identidad (IdP) incluso despu\u00e9s de haber sido deshabilitado por un administrador. Un atacante que conoce el alias del IdP puede reutilizar una solicitud de inicio de sesi\u00f3n generada previamente para eludir la restricci\u00f3n administrativa. Esto socava la aplicaci\u00f3n del control de acceso y puede permitir la autenticaci\u00f3n no autorizada a trav\u00e9s de un proveedor externo deshabilitado."}], "lastModified": "2026-03-24T12:16:12.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*", "vulnerable": true, "matchCriteriaId": "1830E455-7E11-4264-862D-05971A42D4A6"}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:26.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C8F3485-92CB-4F23-A35A-AAA444FDF39E"}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:26.4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8A55A00-BD52-4198-B43A-62919C272AA8"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01FBC63E-BB92-49FF-AA00-BF0FCC17732A"}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A24CBFB-4900-47A5-88D2-A44C929603DC"}, {"criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}