CVE-2026-3009

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

CVE-2026-3009

Keycloak’s IdentityBrokerService.performLogin path is vulnerable to an authentication bypass where an attacker can reuse a previously generated login request to authenticate via a disabled IdP. Multiple sources (Red Hat advisories RHSA-2026:3947/3948, GHSA entry) describe Improper Enforcement of ...

CVE-2026-3009 Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

CVE-2026-3009 Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

CVE-2026-3009

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.14 Images Update

New images are available for Red Hat build of Keycloak 26.2.14 and Red Hat build of Keycloak 26.2.14 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

org.keycloak.broker.saml: Keycloak SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language SAML client is configured as an Identity Provider IdP-initiated broker landing target, it can still complete the login process and establish a Single Sign-On SSO session. This allows a remote attacker...

keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. Thi...

keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +83 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (>=26.0.0, <=26.2.5)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =1.11.0, =0.5.42, =0.6.1 - io.github.jeff-tian:keycloak-sms-provider-aliyun 2.4.1 - io.github.jeff-tian:keycloak-sms-provider-aws-sns 2.4.1 -...

Improper Validation of Specified Type of Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via improper validation of encrypted SAML assertions. An...

com.github.vzakharchenko:radius-disconnect-plugin (1.6.1), com.github.vzakharchenko:radius-plugin (1.6.1) +73 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (>=26.3.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.3.0, =1.1.0, =1.0.1, =1.1.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =0.1.0, =1.11.3, =0.7, =0.47, =0.44, =0.52 and more Source cves: CVE-2026-2092 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15440569...

com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0), com.inventage.keycloak.sms-authenticator:keycloak-sms-authenticator (>=1.2.0, <=1.8.1) +71 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (>=26.5.0, <=26.5.4)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =0.1.1-rc1, =26.1.2-kc26.4.4, =0.6.2, =0.6.5 - io.phasetwo.keycloak:keycloak-account-v1 0.11 and more Source cves: CVE-2026-2092 Source advisory:...

com.github.vzakharchenko:rad-sec-plugin (1.6.1), com.github.vzakharchenko:radius-disconnect-plugin (1.6.1) +88 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (>=26.3.0, <=26.4.7)

org.keycloak:keycloak-server-spi-private MAVEN version =26.3.0, =1.1.0, =1.0.1, =1.1.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =0.1.0, =1.11.3, =0.7, =0.47, =0.50 and more Source cves: CVE-2026-2603 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15440568...

com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0), com.inventage.keycloak.sms-authenticator:keycloak-sms-authenticator (>=1.2.0, <=1.8.1) +81 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (>=26.5.0, <=26.5.4)

org.keycloak:keycloak-server-spi-private MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =0.1.1-rc1, =26.1.2-kc26.4.4, =0.6.2, =0.6.5 - io.phasetwo.keycloak:keycloak-account-v1 0.11 and more Source cves: CVE-2026-2603 Source advisor...

Authentication Bypass by Primary Weakness

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the SAML Identity Provider authentication process when it is...

PT-2026-23494

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A security issue exists in org.keycloak.broker.saml. Specifically, a disabled Security Assertion Markup Language SAML client configured as an Identity Provider IdP-initiated broker landing...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from the fact that disabled SAML clients can still complete the login process. This could allow remote attackers to gain unauthorized access to other enable...

CVE-2026-3009: Incorrect Authorization

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from the IdentityBrokerService.performLogin endpoint allowing authentication with disabled identity providers, potentially leading to bypass of access...