A high-severity authentication bypass vulnerability in Red Hat build of Keycloak allows attackers to generate valid access tokens using credentials from disabled Identity Providers.

The flaw resides in the jwt-authorization-grant flow where the issuer lookup mechanism fails to check the isEnabled status of an Identity Provider. This allows an attacker with access to a signing key from a disabled IdP to obtain authorized access tokens, requiring low-level privileges (authenticated) to trigger.

This vulnerability poses a significant risk to identity and access management systems, as it permits unauthorized access to resources by bypassing established security controls. Given the CVSS score of 8.8, successful exploitation can lead to a complete compromise of confidentiality, integrity, and availability for downstream applications relying on the affected Keycloak instance for authentication.

Immediate Action: Update the Red Hat build of Keycloak to version 26.4.9-1 or later, as provided in the referenced vendor errata.

Proactive Monitoring: Review authentication and authorization logs for anomalous activity associated with disabled Identity Providers or unexpected token issuance patterns.

Compensating Controls: Ensure that signing keys for any decommissioned or disabled Identity Providers are immediately revoked or rotated to prevent potential misuse.

Public Exploit Available: No

The severity of this issue necessitates immediate attention to prevent unauthorized access via legacy or compromised IdP credentials. Administrators must prioritize the application of the provided security patches to ensure that the token issuance logic correctly respects Identity Provider status settings.