CVE-2026-3009

Medium

Elevated severity or exploit probability.

CVSS base

8.1 HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — probability of exploitation (30 days)

0.3%

26.7th percentile

CISA KEV

Not listed

Weakness / dates

CWE-863

Published 2026-03-05 · modified 2026-09-14

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	H	High
Availability	N	None

Timeline

2026-03-05 — Published (NVD)
2026-09-14 — Last modified (NVD)

Description

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

Affected

redhat

References

Official: NVD · CVE.org