The vulnerability CVE-2026-3009 in Red Hat build of Keycloak 26.4 involves improper enforcement of disabled Identity Providers in the IdentityBrokerService.performLogin endpoint. An attacker with knowledge of the IdP alias can reuse an old login request to authenticate via an IdP that an administrator has disabled, effectively bypassing access control mechanisms. This undermines the intended administrative restrictions on authentication sources. The issue is classified under CWE-863 (Incorrect Authorization). The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality and integrity but not availability. Red Hat has published advisories and released version 26.4.10 to fix this and related authentication bypass issues.

Successful exploitation allows an attacker to bypass administrative restrictions by authenticating through an Identity Provider that has been disabled. This leads to unauthorized access, compromising confidentiality and integrity of the authentication process. The vulnerability does not impact availability. There are no known exploits in the wild at the time of publication.

Red Hat has released version 26.4.10 of the Red Hat build of Keycloak which addresses this vulnerability. Users should upgrade to version 26.4.10 or later to remediate the issue. Before applying the update, back up existing installations including applications, configuration files, and databases. No other specific mitigations are indicated by the vendor advisory.