CVE-2026-1486
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-1486 is a high-severity Improperly Implemented Security Check for Standard (CWE-358) vulnerability in Redhat (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Downgrade Attack (T1689); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-1486 is a vulnerability in Keycloak's jwt-authorization-grant flow, where the server fails to verify whether an Identity Provider (IdP) is enabled before issuing tokens. The lookupIdentityProviderFromIssuer mechanism retrieves IdP configuration without filtering for providers where isEnabled=false. As a result, if an administrator disables an IdP—such as due to compromise or offboarding—an entity holding that IdP's signing key can still generate JWT assertions that Keycloak accepts, leading to the issuance of valid access tokens. The issue is rated at CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-358.
An attacker with the private signing key of a disabled IdP can exploit this over the network with low privileges and no user interaction. By crafting valid JWT assertions using the key, the attacker tricks Keycloak into issuing access tokens, enabling unauthorized access to protected resources and potentially full compromise of the authentication flow.
Red Hat advisories RHSA-2026:2365 and RHSA-2026:2366 provide patches addressing this vulnerability. Additional details on mitigation and affected versions are available in the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-1486 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2433347.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6445
Vulnerability Data
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does…
more
not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V17.2.8
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Assessments identify and document improperly implemented security checks, allowing fixes that reduce exploitation of flawed checks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct implementation of standardized security checks and algorithms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance validates that required security checks function as specified.
Use of cryptography control depends on correct implementation of standardized cryptographic checks.
Secure development life cycle mandates verification that security checks required by standards are correctly implemented.
Application security requirements explicitly call for correct implementation of standardized security mechanisms.
Secure system architecture and engineering principles require faithful realization of protocol-level security checks.
Secure coding practices directly address correct implementation of security-relevant checks in standardized algorithms.