A flaw in Keycloak's IdentityBrokerService.performLogin endpoint permits authentication through an Identity Provider that an administrator has disabled. The vulnerability allows an attacker who knows the IdP alias to reuse an earlier login request, thereby circumventing administrative restrictions and enabling unauthorized access. This weakness falls under Improper Authorization (CWE-285) and Failure to Provide Proper Authentication (CWE-863), and can compromise the confidentiality and integrity of protected resources for any user who can invoke the disabled IdP.

The affected products include Red Hat build of Keycloak version 26.4, including the specific 26.4.10 update, Red Hat Single Sign‑On 7, Red Hat JBoss Enterprise Application Platform 8, and its Expansion Pack. These are used in enterprise deployments running the Red Hat Enterprise Linux 9 platform.

The CVSS score of 8.1 indicates high severity, while the EPSS score of < 1 % reflects a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to obtain the IdP alias and craft a login request; no privileged network access is required, suggesting that exploitation could occur in an adversary’s possession of an authenticated user session or a malicious client. The attack path is therefore relatively straightforward once the flaw is recognized.