CVE-2026-3009

moderate-risk
Published 2026-03-05

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / LOW complexity

Affected Products (6)

Jboss Enterprise Application Platform Expansion Pack

Affected Vendors

Redhat

References (4)

Vendor Advisory https://access.redhat.com/errata/RHSA-2026:3947
Vendor Advisory https://access.redhat.com/errata/RHSA-2026:3948
Vendor Advisory https://access.redhat.com/security/cve/CVE-2026-3009
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2441867
41
/ 100
moderate-risk
Severity 28/34 · Critical
Exploitability 0/34 · Minimal
Exposure 13/34 · Low