CVE-2026-1486: Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.4.9 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.5.3 - Configuration
Update Keycloak behavior for the jwt-authorization-grant flow so that the issuer lookup mechanism (lookupIdentityProviderFromIssuer) rejects IdPs where isEnabled=false; disabled identity providers must not be accepted for jwt authorization grant token issuance.
Keycloak jwt-authorization-grant issuer lookup (lookupIdentityProviderFromIssuer) = Filter out disabled Identity Providers (isEnabled=false) before issuing tokens
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1486?
CVE-2026-1486 is classified as a high severity vulnerability due to improper validation of identity providers in jwt authorization grants.
How do I fix CVE-2026-1486?
To fix CVE-2026-1486, ensure that only enabled identity providers are allowed to issue tokens by applying configuration changes or patches provided by Keycloak.
What versions of Keycloak are affected by CVE-2026-1486?
CVE-2026-1486 affects all versions of Keycloak that do not have the necessary updates to validate the enabled status of identity providers.
What impact does CVE-2026-1486 have on security?
CVE-2026-1486 can lead to unauthorized access by accepting tokens from disabled identity providers, compromising the security of applications relying on Keycloak.
Is there a workaround for CVE-2026-1486?
A temporary workaround for CVE-2026-1486 is to manually disable any identity providers that should not be used until an official patch is applied.