CVE detail
CVE-2026-3009
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
5 source links · newest first
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3009.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMar 5, 2026, 7:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2441867bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 5, 2026, 7:16 PM - https://access.redhat.com/security/cve/CVE-2026-3009access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 5, 2026, 7:16 PM - https://access.redhat.com/errata/RHSA-2026:3948access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 5, 2026, 7:16 PM - https://access.redhat.com/errata/RHSA-2026:3947access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 5, 2026, 7:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-3121CVSS 6.5 · Medium
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This al…
- CVE-2026-4874CVSS 3.1 · Low
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token req…
- CVE-2026-4366CVSS 5.8 · Medium
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. Th…
- CVE-2019-14843CVSS 8.8 · High
A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app…
- CVE-2026-28369CVSS 8.7 · High
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping…
- CVE-2026-28368CVSS 8.7 · High
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to…