PT-2026-7128 · Red Hat · Keycloak

Osidb Bzimport · Published 2026-02-09 · Updated 2026-03-10 · CVE-2026-1486

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the jwt-authorization-grant flow where the server does not verify if an Identity Provider (IdP) is enabled before issuing tokens. The lookupIdentityProviderFromIssuer mechanism retrieves the IdP configuration without filtering for the isEnabled status. Consequently, if an administrator disables an IdP, an entity with the IdP’s signing key can still generate valid JWT assertions, leading to the issuance of valid access tokens. This could result in unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2026-1486

GHSA-37GF-GMXV-74WV

Affected Products

Keycloak

References · 19

• https://access.redhat.com/errata/RHSA-2026:2366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1486 · Security Note
• https://osv.dev/vulnerability/GHSA-37gf-gmxv-74wv · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:2365 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/8316e8538f0037d9f998181e73122cff93a94035 · Note
• https://github.com/keycloak/keycloak/commit/176dc8902ce552056d3648c4601d519afc6fb043 · Note
• https://github.com/keycloak/keycloak/pull/46148 · Note
• https://github.com/keycloak/keycloak/issues/46146 · Note
• https://access.redhat.com/security/cve/CVE-2026-1486 · Note
• https://t.me/cveNotify/151507 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2433347 · Note
• https://twitter.com/CCBalert/status/2021248220869865668 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post