Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

The primary impact of CVE-2026-3009 is unauthorized access to Keycloak-protected resources. An attacker who knows the alias of a previously configured Identity Provider (even if disabled) can leverage a cached or replayed login request to authenticate as if the IdP were still active. This bypasses the intended security controls and allows the attacker to gain access to applications and services relying on Keycloak for authentication. The blast radius extends to any application or service integrated with Keycloak and relying on the IdP for authentication, potentially exposing sensitive data and enabling further lateral movement within the environment. This vulnerability shares similarities with other authentication bypass flaws where cached credentials or replay attacks can circumvent access controls.

Organizations heavily reliant on Keycloak for single sign-on (SSO) and federated identity management are at significant risk. Environments with numerous Identity Providers, particularly those that are frequently enabled and disabled, are especially vulnerable. Shared hosting environments utilizing Keycloak should also be prioritized for patching.

• java / server:

# Check Keycloak version
java -jar keycloak.jar --version

• java / server:

# Monitor Keycloak logs for suspicious login attempts involving disabled IdPs
grep -i 'disabled identity provider' /path/to/keycloak/logs/keycloak.log

• generic web:

# Check for exposed IdentityBrokerService endpoint
curl -I https://keycloak.example.com/auth/realms/master/broker/identityprovider/idp-alias/endpoint

1. 2026-03-05Disclosure

   disclosure

1. Gereserveerd2026-02-23
2. Gepubliceerd2026-03-05
3. Gewijzigd2026-03-24
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-3009 is to upgrade Keycloak to a version containing the fix. Until the upgrade can be performed, consider temporarily disabling the IdentityBrokerService or restricting access to the performLogin endpoint. Implementing stricter rate limiting on the performLogin endpoint can also help mitigate the risk of replay attacks. Review Keycloak's audit logs for suspicious login attempts, particularly those involving disabled IdPs. After upgrading, confirm the fix by attempting to authenticate through a disabled IdP using a previously generated login request – it should fail.