A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.

Keycloak versions installed prior to 26.5.3 are affected by multiple vulnerabilities as referenced in the advisory.

  - A flaw in Keycloak where the JSON Web Token (JWT) authorization grant preview feature fails to validate a user's   disabled status during JWT authorization grant processing. When this feature is enabled, disabled user accounts   can still be used to obtain valid JWTs. (CVE-2026-1609)

  - An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate   invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the   attacker to successfully self-register into an unauthorized organization, leading to unauthorized   access. (CVE-2026-1529)

  - A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity   Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer)   retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP   (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid   JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens. (CVE-2026-1486)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server
    fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup
    mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for
    isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity
    possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting
    in the issuance of valid access tokens. (CVE-2026-1486)

ID	Name	Product	Family	Severity
298654	Keycloak < 26.5.3 Multiple Vulnerabilities	Nessus	Misc.	high
437676	SCA: security update for org.keycloak:keycloak-services (GHSA-37gf-gmxv-74wv)	Tenable Cloud Security	SCA Checks	high
437676	SCA: security update for org.keycloak:keycloak-services (GHSA-37gf-gmxv-74wv)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-1486

high

Tenable Plugins

high

high

high