{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3009.json"
      }
    ],
    "title": "org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)",
    "tracking": {
      "current_release_date": "2026-08-03T14:15:54+00:00",
      "generator": {
        "date": "2026-08-03T14:15:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "CVE-2026-3009",
      "initial_release_date": "2026-03-05T11:23:00+00:00",
      "revision_history": [
        {
          "date": "2026-03-05T11:23:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-03-30T07:27:45+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-08-03T14:15:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 8",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 8",
                  "product_id": "red_hat_jboss_enterprise_application_platform_8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform 8"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
                  "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jbosseapxp"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Single Sign-On 7",
                "product": {
                  "name": "Red Hat Single Sign-On 7",
                  "product_id": "red_hat_single_sign-on_7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Single Sign-On 7"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.4",
                "product": {
                  "name": "Red Hat build of Keycloak 26.4",
                  "product_id": "9Base-RHBK-26.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.4.10",
                "product": {
                  "name": "Red Hat build of Keycloak 26.4.10",
                  "product_id": "Red Hat build of Keycloak 26.4.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "category": "product_version",
            "name": "keycloak-services",
            "product": {
              "name": "keycloak-services",
              "product_id": "keycloak-services",
              "product_identification_helper": {
                "purl": "pkg:maven/org.keycloak/keycloak-services"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.4-12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle&tag=26.4.10-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.4-12"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd?arch=s390x&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.4-12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf?arch=s390x&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.4-12"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7?arch=arm64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.4-12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7?arch=arm64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.4-12"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899?arch=ppc64le&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.4-12"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814?arch=ppc64le&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.4-12"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "keycloak-services as a component of Red Hat JBoss Enterprise Application Platform 8",
          "product_id": "red_hat_jboss_enterprise_application_platform_8:keycloak-services"
        },
        "product_reference": "keycloak-services",
        "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "keycloak-services as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services"
        },
        "product_reference": "keycloak-services",
        "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "keycloak-services as a component of Red Hat Single Sign-On 7",
          "product_id": "red_hat_single_sign-on_7:keycloak-services"
        },
        "product_reference": "keycloak-services",
        "relates_to_product_reference": "red_hat_single_sign-on_7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3009",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2026-02-23T04:55:39.695000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_jboss_enterprise_application_platform_8:keycloak-services"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2441867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The security impact of this vulnerability is considered High because it allows bypassing an explicit administrative security control. Even though user interaction is required, an attacker can authenticate using an Identity Provider that administrators intentionally disabled. This weakens identity governance controls and may result in unauthorized access depending on the trust level of the external IdP. The root cause is insufficient authorization validation during broker login processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
          "Red Hat build of Keycloak 26.4.10"
        ],
        "known_affected": [
          "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services",
          "red_hat_single_sign-on_7:keycloak-services"
        ],
        "known_not_affected": [
          "red_hat_jboss_enterprise_application_platform_8:keycloak-services"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3009"
        },
        {
          "category": "external",
          "summary": "RHBZ#2441867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3009",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3009"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3009",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3009"
        }
      ],
      "release_date": "2026-03-05T11:23:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-05T19:09:49+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3948"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-05T19:07:56+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat build of Keycloak 26.4.10"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3947"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
            "Red Hat build of Keycloak 26.4.10",
            "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services",
            "red_hat_single_sign-on_7:keycloak-services"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "red_hat_single_sign-on_7:keycloak-services"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
            "Red Hat build of Keycloak 26.4.10",
            "red_hat_jboss_enterprise_application_platform_8:keycloak-services",
            "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services",
            "red_hat_single_sign-on_7:keycloak-services"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x",
            "Red Hat build of Keycloak 26.4.10",
            "red_hat_jboss_enterprise_application_platform_8:keycloak-services",
            "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services",
            "red_hat_single_sign-on_7:keycloak-services"
          ]
        }
      ],
      "title": "org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)"
    }
  ]
}