CVE-2026-3009HIGH 8.1EPSS p25.9%

CVE-2026-3009CVE-2026-3009

redhat / build_of_keycloak

Description

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

Scoring

CVSS 3.18.1 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS0.33% probability of exploitation · percentile 25.9% · 2026-08-03T12:00:16Z
Published2026-03-05
Last modified2026-08-03

Underlying weaknesses· 1

CWE-863

References

  1. https://access.redhat.com/errata/RHSA-2026:3947
  2. https://access.redhat.com/errata/RHSA-2026:3948
  3. https://access.redhat.com/security/cve/CVE-2026-3009
  4. https://bugzilla.redhat.com/show_bug.cgi?id=2441867

1

TypeTargetConfidenceTier
WeaknessIncorrect Authorizationcwe-8630%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-3047
CVE
CVE-2026-2603
CVE
CVE-2026-1486
CVE
CVE-2026-7507
CVE
CVE-2026-7571
CVE
CVE-2026-9087
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.