CVE-2026-1486: 
Java vulnerability analysis and mitigation

CVE-2026-1486 is a security bypass vulnerability in Keycloak's JWT authorization grant flow where the server fails to verify whether an Identity Provider (IdP) is enabled before issuing tokens. The flaw resides in the lookupIdentityProviderFromIssuer mechanism, which retrieves IdP configuration without filtering for isEnabled=false. Affected versions include org.keycloak:keycloak-services >= 26.5.0 and < 26.5.3, and all versions < 26.4.9. It was disclosed on February 9, 2026, with a CVSS v3.1 base score of 8.8 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-358 (Improperly Implemented Security Check for Standard): the lookupIdentityProviderFromIssuer function in org.keycloak.protocol.oidc.grants retrieves an IdP's configuration during the JWT authorization grant flow but does not check the isEnabled flag before proceeding (Red Hat Bugzilla). An attacker who possesses a disabled IdP's signing key can craft a valid JWT assertion and submit it to Keycloak's token endpoint over the network with low privileges required and no user interaction. The attack vector is network-based with low complexity, making it straightforward to exploit once the signing key is obtained. Relevant fix commits are available in the Keycloak repository (keycloak/keycloak@176dc89 and keycloak/keycloak@8316e85) (GitHub Advisory).

Successful exploitation allows an attacker to obtain valid Keycloak access tokens by impersonating users associated with a disabled IdP, even after that IdP has been administratively disabled as a security response to a compromise or offboarding event. This undermines the intended security control of disabling an IdP, enabling unauthorized access to all applications and services relying on Keycloak for authentication. The vulnerability carries high confidentiality, integrity, and availability impacts, and could facilitate lateral movement across integrated systems and account takeovers (GitHub Advisory, Red Hat Advisory).

1. Obtain a disabled IdP's signing key: The attacker must already possess or have exfiltrated the private signing key of an Identity Provider that has been disabled in Keycloak (e.g., through a prior compromise of the IdP).
2. Craft a malicious JWT assertion: Using the stolen signing key, the attacker creates a signed JWT assertion with claims matching a target user (e.g., sub, iss pointing to the disabled IdP's issuer URL).
3. Submit the JWT to Keycloak's token endpoint: The attacker sends an HTTP POST request to Keycloak's token endpoint using the urn:ietf:params:oauth:grant-type:jwt-bearer grant type, including the crafted JWT as the assertion parameter.
4. Bypass the disabled IdP check: Keycloak's lookupIdentityProviderFromIssuer retrieves the IdP configuration without checking isEnabled=false, accepting the JWT as valid.
5. Receive a valid access token: Keycloak issues a valid access token for the impersonated user, which the attacker can use to authenticate to downstream applications and services integrated with Keycloak (Red Hat Bugzilla, GitHub Advisory).

• Network: Unexpected JWT bearer grant requests (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer) to the Keycloak token endpoint originating from unusual or untrusted sources; token issuance activity associated with IdP issuers that are known to be disabled.
• Logs: Keycloak server logs showing successful token issuances via the JWT authorization grant flow for IdPs that are in a disabled state; audit log entries for access token generation without corresponding active IdP session activity.
• Application: Downstream application access logs showing authenticated sessions for users whose IdP was disabled, particularly if those sessions were not preceded by a normal interactive login flow.

Upgrade org.keycloak:keycloak-services to version 26.4.9 or 26.5.3, which contain the fix (GitHub Advisory). Red Hat build of Keycloak users should apply RHSA-2026:2365 (standalone) or RHSA-2026:2366 (OpenShift container images) (Red Hat RHSA-2026:2365, Red Hat RHSA-2026:2366). As interim mitigations: audit and rotate signing keys for any previously compromised or disabled IdPs; implement network-level controls to restrict JWT authorization grant requests to trusted networks; and review Keycloak audit logs for any unauthorized token issuances that may have occurred while the vulnerability was present.

The vulnerability was covered by The Hacker Wire, which published an article and social media posts on Mastodon and Bluesky highlighting the IdP bypass issue (The Hacker Wire). Red Hat issued the vulnerability as "Important" severity in its security advisories, reflecting the significant authentication bypass risk for enterprise Keycloak deployments (Red Hat RHSA-2026:2365). Community reaction has been moderate, with the issue tracked across multiple vulnerability aggregators and security feeds shortly after disclosure.