A flaw in the jwt-authorization-grant flow of Keycloak causes the server to issue tokens without confirming that the Identity Provider (IdP) is enabled. By bypassing the isEnabled check, Keycloak accepts JWT assertions signed with a disabled IdP's private key, resulting in the issuance of valid access tokens to attackers who possess that key.

Red Hat build of Keycloak 26.4, including version 26.4.9 on Red Hat Enterprise Linux 9, is affected. The vulnerability was identified by Red Hat and documented for the Red Hat build of Keycloak 26.4.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely but possible. Because the vulnerability requires an attacker to possess a disabled IdP's signing key, the attack surface is limited to environments where compromised or offboarded keys are accessible. If an attacker obtains the key, the flaw permits the creation of valid tokens that grant access to protected resources, potentially enabling impersonation or privilege escalation. The flaw is not listed in CISA’s KEV catalog.