Security readout for executives and security teams
Plain-English summary
Keycloak may still trust a disabled identity provider during a JWT authorization grant. If that provider was disabled because it was compromised or retired, someone with its signing key could still obtain valid access tokens. This is high urgency for organizations using Red Hat build of Keycloak 26.4 with external IdPs.
Executive priority
Prioritize remediation for Keycloak environments that rely on external IdPs for production access. The business risk is unauthorized token issuance after trust was intentionally revoked, which can undermine account offboarding and compromise response.
Technical view
The flaw is in Keycloak's jwt-authorization-grant flow. lookupIdentityProviderFromIssuer retrieves IdP configuration without excluding isEnabled=false, so JWT assertions from disabled IdPs can still be accepted and exchanged for access tokens. Red Hat rates this high with CVSS 3.1 score 8.8, requiring network access and low privileges.
Likely exposure
Exposure is likely where Red Hat build of Keycloak 26.4 affected packages are deployed and JWT authorization grant is used with brokered identity providers. Risk is highest where IdPs were disabled for compromise, offboarding, or trust revocation reasons.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation depends on an entity possessing a disabled IdP's signing key and being able to submit JWT assertions accepted by Keycloak.
Researcher notes
Evidence is strongest for Red Hat build of Keycloak 26.4 package status and the described missing isEnabled check. The bundle does not provide exploit details, broad upstream version mapping, or proof of exploitation, so avoid assuming impact beyond listed products.
Mitigation direction
- Apply Red Hat guidance in RHSA-2026:2365 and RHSA-2026:2366.
- Upgrade only to vendor-listed fixed or unaffected Keycloak builds.
- Inventory disabled IdPs and treat disablement alone as insufficient until patched.
- Rotate or revoke IdP signing material when compromise or offboarding drove disablement.
- Review Red Hat CVE guidance before applying compensating controls.
Validation and detection
- Identify deployed Red Hat build of Keycloak 26.4 packages and exact versions.
- Check whether rhbk/keycloak-rhel9, operator, or operator-bundle packages match affected entries.
- Review realms using jwt authorization grant with brokered IdPs.
- List disabled IdPs and confirm why each was disabled.
- After patching, verify disabled IdPs no longer issue accepted token flows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-358: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1486 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9redhatCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- ADP timelineredhat-SADP
Reported to Red Hat.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-27T13:34:53.016Z: Reported to Red Hat.
- 2026-02-09T18:23:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:2365CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:2366CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-1486CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2433347CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1486.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improperly Implemented Security Check for Standard
Improperly Implemented Security Check for Standard represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.