CVE-2026-1486

The record

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

Affected packages

Related vulnerabilities

• GHSA-37gf-gmxv-74wv Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens Same vulnerability
• GHSA-7g5x-9c4v-4w5r Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass Also affects org.keycloak:keycloak-services
• CVE-2025-12150 A flaw was found in Keycloak’s WebAuthn registration component. Also affects org.keycloak:keycloak-services
• GHSA-fjf4-6f34-w64q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol Also affects org.keycloak:keycloak-services
• CVE-2026-2733 A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens… Also affects org.keycloak:keycloak-services
• GHSA-hcvw-475w-8g7p Keycloak affected by improper invitation token validation Also affects org.keycloak:keycloak-services
• GHSA-fm6w-rrp3-2x4w Keycloak Affected by Broken Access Control Vulnerability in the… Also affects org.keycloak:keycloak-services
• CVE-2026-1529 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-services