Threats Tagged 'cve-2026-1486'

Red Hat has released a security advisory for the Red Hat build of Keycloak 26.4.9 images used on OpenShift Container Platform. The update addresses multiple security vulnerabilities including improper invitation token validation, acceptance of disabled identity providers for JWT authorization, incorrect ownership checks, unauthorized modification of user attributes, unauthorized token issuance for disabled users, and exposure of sensitive user attributes via the Admin API. These issues could allow unauthorized access or privilege escalation within Keycloak deployments. The advisory provides updated container images to remediate these vulnerabilities.

Red Hat build of Keycloak 26.4.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * Unauthorized organization registration via improper invitation token validation (CVE-2026-1529) * Disabled identity providers are still accepted for JWT Authorization Grant (CVE-2026-1486) * Incorrect ownership checks in /uma-policy/ (CVE-2025-14778) * Unauthorized modification of unmanaged user attributes by administrators (CVE-2026-0871) * keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users (CVE-2025-14559) * Limited administrator can retrieve sensitive user attributes via Admin API (CVE-2025-13881)

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.