CVE-2026-1486 — Vulnerability in org.keycloak:keycloak-services —...

HIGH

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Published February 9, 2026Updated February 13, 2026Source: osv

Summary

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

Advisory Timeline

First published February 9, 2026 (245 days ago).
Last revised February 13, 2026 — 4 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.keycloak:keycloak-services to 26.4.9 or later

<!-- Update pom.xml dependency version to 26.4.9 for org.keycloak:keycloak-services -->

Maven

Update org.keycloak:keycloak-services to 26.5.3 or later

<!-- Update pom.xml dependency version to 26.5.3 for org.keycloak:keycloak-services -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.keycloak:keycloak-services	maven	1.0-alpha-1, 1.0-alpha-1-12062013, 1.0-alpha-2, 1.0-alpha-3 (+212 more)	26.4.9
org.keycloak:keycloak-services	maven	26.5.0, 26.5.1, 26.5.2	26.5.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-358
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-1486?: Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-1486?: CVE-2026-1486 affects org.keycloak:keycloak-services. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-1486 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-37gf-gmxv-74wv

Related CVEs

CVE-2022-4361
CRITICAL
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
CVE-2026-18963
CRITICAL
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
CVE-2026-61570
HIGH
MPXJ: XXE Vulnerability in MerlinReader
CVE-2026-3047
HIGH
Keycloak SAML Broken has Authentication Bypass by Primary Weakness
CVE-2026-1529
HIGH
Keycloak affected by improper invitation token validation
CVE-2026-107725
HIGH
Hazelcast has an authorization bypass in IMap Predicates API

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies