High · published February 9, 2026
🚨 A disabled Identity Provider can still issue tokens! If an IdP is turned off, the server doesn’t check its status before giving out access — it’s like letting an expired VIP pass still grant entry to a concert! 🎟️ Think of it like an exclusive event where someone still sneaks in using an old ticket. Just because the guest list was revoked doesn’t mean the ticket isn’t accepted by the clueless door staff. An attacker with access to a disabled IdP's signing key can generate valid JWT assertions, leading to unauthorized access. It’s a recipe for disaster: they could waltz in and access sensitive resources with a token that should no longer be valid, potentially compromising your entire system! ⚡
Think of it like an exclusive event where someone still sneaks in using an old ticket. Just because the guest list was revoked doesn’t mean the ticket isn’t accepted by the clueless door staff. This flaw in Keycloak's jwt-authorization-grant flow arises because the server fails to verify if an Identity Provider is enabled before issuing tokens. The lookup mechanism retrieves IdP configurations without filtering for their enabled status, creating a substantial security risk.
An attacker with access to a disabled IdP's signing key can generate valid JWT assertions, leading to unauthorized access. It’s a recipe for disaster: they could waltz in and access sensitive resources with a token that should no longer be valid, potentially compromising your entire system! ⚡ To mitigate this issue, ensure you upgrade to the latest Keycloak version that addresses this flaw. Additionally, regularly review your Identity Provider configurations and disable any that are no longer in use to reinforce security. Don’t forget to audit your signing keys, too! 🔒 You’ve got this! By following these steps, you’ll be on your way to securing your Keycloak setup in no time. 🛡️