CVE-2026-3009

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A security flaw in the 'IdentityBrokerService.performLogin' endpoint allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass this administrative restriction, undermining access control and potentially allowing unauthorized authentication through a disabled external provider.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.