The vulnerability exists in the jwt-authorization-grant flow of Red Hat build of Keycloak 26.4. The server's issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not check whether the IdP is enabled. Consequently, if an administrator disables an IdP (for example, due to compromise or offboarding), an attacker with access to that IdP's signing key can still generate valid JWT assertions. Keycloak accepts these assertions and issues valid access tokens, bypassing the intended disablement of the IdP. This is classified as CWE-358 (Improperly Implemented Security Check). The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker who possesses the signing key of a disabled Identity Provider can still generate valid JWT assertions that Keycloak will accept, resulting in unauthorized issuance of valid access tokens. This undermines the security control intended by disabling the IdP, potentially allowing unauthorized access to protected resources and services. The impact affects confidentiality, integrity, and availability of the system.

Red Hat has released updated packages for Red Hat build of Keycloak version 26.4.9 that address this vulnerability. Users should apply the security update to version 26.4.9 or later as provided in the Red Hat advisories RHSA-2026:2365 and RHSA-2026:2366. Before updating, back up existing installations including applications, configuration files, and databases. No other mitigations are specified by the vendor. Patch status is official-fix with available updates.