Improper Authorization vulnerability in the IdentityBrokerService.performLogin endpoint of the Keycloak services component. The flaw occurs because the broker login endpoint does not re-validate the enabled/disabled status of the configured Identity Provider (IdP) at the time of login processing. If a valid authentication flow is initiated before the IdP is disabled, an attacker who knows the broker alias can manually invoke the broker login URL (/realms/{realm}/broker/{alias}/login) with valid session parameters. Despite the IdP being administratively disabled, the authentication flow proceeds and redirects the user to the external provider. This allows authentication via a disabled IdP, effectively bypassing administrative access control restrictions. The issue can be exploited remotely without privileges but requires user interaction and knowledge of the IdP alias.