This vulnerability in Red Hat build of Keycloak 26.4 involves improper enforcement of disabled Identity Providers in the IdentityBrokerService.performLogin endpoint. Specifically, even after an administrator disables an IdP, authentication requests using that IdP can still succeed if an attacker reuses a previously generated login request with the known IdP alias. This bypasses administrative restrictions and access control mechanisms, allowing unauthorized authentication through a disabled external provider. The issue is tracked as CVE-2026-3009 with a CVSS 3.1 base score of 8.1 (high severity). Red Hat has published security advisories and released version 26.4.10 to fix this flaw.

The vulnerability allows attackers with knowledge of the IdP alias to bypass administrative controls that disable an Identity Provider, enabling unauthorized authentication. This compromises the integrity and confidentiality of authentication processes, potentially granting attackers access to protected resources without proper authorization. The impact is high as it affects access control enforcement and could lead to unauthorized access to systems relying on Keycloak for authentication.

Red Hat has released an official fix in Red Hat build of Keycloak version 26.4.10. Users should upgrade to version 26.4.10 or later to remediate this vulnerability. Before applying the update, it is recommended to back up existing installations, including applications, configuration files, and databases. No alternative mitigations are specified in the vendor advisories, so applying the official update is the primary remediation step.