8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1486

CVE-2026-1486: Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1486

CVE-2026-1486:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.5.3	26.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Keycloak's failure to verify if an Identity Provider (IdP) is enabled before processing authentication or authorization requests based on JWTs issued by that IdP. An administrator might disable an IdP due to a compromise, but without this check, Keycloak would still trust tokens signed by the compromised IdP's key.

The analysis of the security patch 176dc8902ce552056d3648c4601d519afc6fb043 reveals two key locations where this check was missing:

org.keycloak.authentication.authenticators.client.FederatedJWTClientAuthenticator.authenticateClient: This method is responsible for authenticating clients using JWTs from a federated IdP. The patch adds a check, !lookup.identityProviderModel().isEnabled(), to ensure the IdP is active before proceeding. The absence of this check meant that a client could be authenticated using a token from a disabled IdP.
org.keycloak.protocol.oidc.grants.JWTAuthorizationGrantType.process: This method handles the JWT authorization grant flow. The patch introduces a check, !identityProviderModel.isEnabled(), and throws an exception if the IdP is disabled. Previously, this method would process grant requests and issue access tokens even if the originating IdP was disabled, as long as the JWT was correctly signed.

These two functions are the entry points where a malicious JWT from a disabled IdP would be processed. During an exploit, a runtime profile would show calls to these functions as they validate the malicious token and incorrectly grant access. The fix in both cases was to add an explicit check for the isEnabled status of the Identity Provider.

Vulnerable functions

org.keycloak.authentication.authenticators.client.FederatedJWTClientAuthenticator.authenticateClient

services/src/main/java/org/keycloak/authentication/authenticators/client/FederatedJWTClientAuthenticator.java

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.