What is the CVSS score of CVE-2026-3009?

CVE-2026-3009 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Build Of Keycloak are affected by CVE-2026-3009?

A critical authentication bypass vulnerability in Keycloak allows users to log in through identity providers that administrators have explicitly disabled, potentially enabling unauthorized access to…. A patch is available.

How to fix or mitigate CVE-2026-3009?

Within 24 hours: Audit all disabled identity providers in Keycloak and review recent authentication logs for suspicious activity using disabled IdPs. Within 7 days: Implement network-level restrictions to limit Keycloak access to trusted networks only and enforce multi-factor authentication where possible. Within 30 days: Establish a change management process requiring immediate Keycloak restart or service isolation following any IdP disablement, and evaluate alternative authentication platforms if patch availability remains uncertain.

Build Of Keycloak CVE-2026-3009

HIGH

Improper Authorization (CWE-285)

2026-03-05 secalert@redhat.com

GHSA-m297-3jv9-m927

Authentication Bypass Build Of Keycloak Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack Single Sign On

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

43 maven packages depend on org.keycloak:keycloak-services (15 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.5.5.

DescriptionNVD

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

AnalysisAI

Keycloak's IdentityBrokerService.performLogin endpoint fails to enforce disabled Identity Provider restrictions, allowing attackers with knowledge of an IdP alias to reuse previous login requests and authenticate through administratively disabled external providers. This authentication bypass affects any Keycloak deployment relying on IdP disablement as an access control mechanism. An attacker can exploit this to gain unauthorized access by circumventing intended administrative restrictions on external authentication sources.

Technical ContextAI

Classified as CWE-285 (Improper Authorization). Affects Build Of Keycloak. A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.