A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server
    fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup
    mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for
    isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity
    possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting
    in the issuance of valid access tokens. (CVE-2026-1486)

Keycloak versions installed prior to 26.5.3 are affected by multiple vulnerabilities as referenced in the advisory.

  - A flaw in Keycloak where the JSON Web Token (JWT) authorization grant preview feature fails to validate a user's   disabled status during JWT authorization grant processing. When this feature is enabled, disabled user accounts   can still be used to obtain valid JWTs. (CVE-2026-1609)

  - An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate   invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the   attacker to successfully self-register into an unauthorized organization, leading to unauthorized   access. (CVE-2026-1529)

  - A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity   Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer)   retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP   (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid   JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens. (CVE-2026-1486)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460235	Echo: org.keycloak:keycloak-services: security update to 26.4.9	Tenable Cloud Security	Echo Local Security Checks	Local	high
460235	Echo: org.keycloak:keycloak-services: security update to 26.4.9	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
298654	Keycloak < 26.5.3 Multiple Vulnerabilities	Nessus	Misc.	Local	high
437676	SCA: security update for org.keycloak:keycloak-services (GHSA-37gf-gmxv-74wv)	Tenable Cloud Security	SCA Checks	Local	high
437676	SCA: security update for org.keycloak:keycloak-services (GHSA-37gf-gmxv-74wv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-1486

high

Tenable Plugins

high

high

high

high

high