Authentication Bypass in Keycloak Affects Token Issuance

CVE-2026-1486

What is CVE-2026-1486?

A vulnerability exists in the jwt-authorization-grant flow of Keycloak where the server does not adequately verify if an Identity Provider (IdP) is active prior to issuing tokens. The lookup mechanism retrieves the IdP configuration without confirming its enabled status. Consequently, if an administrator has disabled an IdP—possibly due to a security breach—entities that possess that IdP's signing key can still produce valid JWT assertions that Keycloak accepts. This oversight can result in the unintended issuance of valid access tokens, creating potential security risks within the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References