CVE-2026-3009 Red Hat CVE debrief

Who should care

Defenders managing Keycloak deployments, especially those using external IdPs, should assess exposure and verify access control configurations. This includes verifying the effectiveness of their access control configurations and monitoring for suspicious authentication attempts through disabled IdPs.

Why it matters

CVE-2026-3009 allows authentication to proceed using a disabled Identity Provider (IdP) in Keycloak, undermining access control enforcement. Defenders managing Keycloak deployments should verify exposure, assess access control configurations, and monitor for suspicious authentication attempts.

• Verification of Keycloak deployments for exposure to unauthorized authentication
• Assessment of access control configurations and effectiveness
• Monitoring for suspicious authentication attempts through disabled IdPs
• Review and update of administrative restrictions on IdP usage

Technical summary

The IdentityBrokerService.performLogin endpoint in Keycloak allows authentication to proceed with a disabled Identity Provider (IdP). An attacker knowing the IdP alias can reuse a previous login request, bypassing administrative restrictions. This undermines access control enforcement, potentially allowing unauthorized authentication through a disabled external provider. Defenders managing Keycloak deployments, especially those using external IdPs, should assess exposure and verify access control configurations. The CVE record and NVD entry provide details on the vulnerability. Vendor advisories from Red Hat offer additional context and mitigation guidance.

Defensive priority

Defenders should prioritize verifying exposure of Keycloak deployments, especially those using external IdPs, and assess the effectiveness of their access control configurations.

Recommended defensive actions

• Verify Keycloak deployments for exposure, especially those using external IdPs
• Assess access control configurations and effectiveness
• Review and update administrative restrictions on IdP usage
• Monitor for suspicious authentication attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Vendor advisories from Red Hat offer additional context and mitigation guidance. The IdentityBrokerService.performLogin endpoint in Keycloak allows authentication to proceed with a disabled Identity Provider (IdP). An attacker knowing the IdP alias can reuse a previous login request, bypassing administrative restrictions. This undermines access control enforcement, potentially allowing unauthorized authentication through a disabled external provider. Defenders should

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.