Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

The impact of CVE-2026-1486 is significant. An attacker who obtains an IdP's signing key, even if the IdP is disabled, can impersonate legitimate users and gain unauthorized access to Keycloak-protected resources. This could lead to data breaches, privilege escalation, and complete compromise of the Keycloak instance. The ability to generate valid tokens bypasses standard authentication mechanisms, making detection more difficult. This vulnerability shares similarities with other JWT-related attacks where improper validation of issuer claims can lead to unauthorized access.

Organizations heavily reliant on Keycloak for authentication and authorization, particularly those utilizing multiple Identity Providers, are at significant risk. Environments with legacy IdP configurations or those that have offboarded users without properly revoking their access tokens are especially vulnerable.

• java / server:

# Check Keycloak version
java -jar keycloak.jar --version

• java / server:

# Review Keycloak logs for JWT assertions from disabled Identity Providers. Look for errors related to IdP lookup and validation.
grep -i 'disabled idp' /path/to/keycloak/logs/keycloak.log

1. 2026-02-09Disclosure

   disclosure

1. Reservado2026-01-27
2. Publicada2026-02-09
3. Modificada2026-02-13
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-1486 is to immediately upgrade Keycloak to version 26.5.3 or later. If upgrading is not immediately feasible, consider temporarily disabling the affected IdP(s) to prevent further exploitation. While this limits functionality, it reduces the attack surface. Implement strict access controls and regularly rotate IdP signing keys to minimize the impact of a potential key compromise. Monitor Keycloak logs for suspicious JWT activity, particularly assertions from disabled IdPs.