What is the CVSS score of CVE-2026-1486?

CVE-2026-1486 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Keycloak. are affected by CVE-2026-1486?

CVE-2026-1486 is a critical authentication bypass vulnerability in Keycloak's JWT authorization flow that could allow attackers to obtain unauthorized tokens by bypassing Identity Provider validation…. A patch is available.

How to fix or mitigate CVE-2026-1486?

Within 24 hours: Audit all Keycloak instances in your environment and document which ones are actively used for production authentication. Immediately disable the jwt-authorization-grant flow if not essential to operations, or restrict its usage to trusted internal networks only. Within 7 days: Implement enhanced monitoring and logging around token issuance and IdP validation failures; review recent authentication logs for suspicious token requests. Within 30 days: Continue monitoring vendor security advisories for patch availability; evaluate alternative authentication flows or Keycloak version upgrades as mitigation strategies; conduct a security assessment of systems that depend on affected Keycloak instances.

Keycloak. CVE-2026-1486

HIGH

Improperly Implemented Security Check for Standard (CWE-358)

2026-02-09 secalert@redhat.com

GHSA-37gf-gmxv-74wv

Denial Of Service

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 09, 2026 - 20:15 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.5.0.

DescriptionCVE.org

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

AnalysisAI

Keycloak's JWT authorization grant flow fails to verify that an Identity Provider is enabled before accepting tokens signed by its key, allowing attackers with a disabled IdP's signing credentials to obtain valid access tokens. This authentication bypass affects organizations that have disabled IdPs due to compromise or offboarding but retain the associated signing keys. An attacker can exploit this to gain unauthorized access to systems relying on Keycloak for authentication.