CVE-2026-1486: Keycloak Services Token Issuance Vulnerability Due to IdP Verification Failure
Summary
CVE-2026-1486: Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. Affects org.keycloak:keycloak-services versions < 26.5.3. Fixed in 26.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows users to secure applications and services with little to no code. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. The package 'keycloak-services' is a core component that handles various authentication and authorization flows. However, it has a critical vulnerability that affects its ability to properly verify the status of Identity Providers (IdPs), potentially leading to unauthorized access.
Vulnerability Detail
A flaw was found in Keycloak's jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism retrieves the IdP configuration but does not filter for isEnabled=false. This means that if an administrator disables an IdP (for example, due to a security compromise), an entity that possesses that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens. This vulnerability can lead to unauthorized access to sensitive resources and data.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.5.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators should ensure that any disabled IdPs are not used in production environments. Additionally, consider implementing additional access controls and monitoring to detect any unauthorized token usage until the package is updated.
Conclusion
In summary, the vulnerability identified as CVE-2026-1486 in Keycloak's 'keycloak-services' package poses a significant risk due to improper verification of Identity Providers before token issuance. It is crucial to update to version 26.5.3 or later to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, implement strict access controls and monitor token usage to mitigate potential risks.
The potential consequences include unauthorized access to sensitive resources and data, leading to security breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
