A vulnerability in the Keycloak IdentityBrokerService allows authenticated attackers to bypass administrative restrictions and authenticate via disabled external identity providers.

This flaw, categorized as CWE-863, occurs when the IdentityBrokerService fails to verify if an Identity Provider is active before processing a login request. An attacker with low-level privileges can leverage a known IdP alias to successfully authenticate despite the administrator having disabled that provider.

The ability to bypass disabled authentication providers grants unauthorized access to internal systems and sensitive user data. Given the CVSS score of 8.1, this flaw represents a significant risk to organizational identity management and access control integrity. If exploited, attackers could maintain persistent access or impersonate users through restricted channels, leading to potential data breaches or privilege escalation.

Immediate Action: Administrators must update the Red Hat build of Keycloak to version 26.4.10-1 or 26.4-12 as specified in the Red Hat security advisories.

Proactive Monitoring: Review authentication logs specifically for login attempts originating from identity providers that are marked as disabled in the administrative console.

Compensating Controls: Disable or restrict access to the IdentityBrokerService endpoint via network-level controls or a Web Application Firewall if immediate patching is not feasible.

Public Exploit Available: No

The vulnerability presents a high risk to authentication security by undermining administrative controls. Organizations should prioritize the application of the provided vendor patches to ensure that disabled identity providers cannot be leveraged for unauthorized access. Immediate testing and deployment of these updates are strongly advised to maintain the integrity of the identity management framework.