CVE-2026-3009

Katalog CVE

CVSS 8.1 · High EPSS 0,49%

Kerentanan Incorrect Authorization pada redhat build of keycloak, redhat jboss enterprise application platform +2 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

Rincian

Terbit di NVD

5 Maret 2026

Terakhir diubah

14 September 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:3947 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3948 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-3009 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2441867 issue tracking · advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3009.json