HarborGuard / CVE
Back to search
HIGHCVE-2026-3047Published Modified CNA redhat

CVE-2026-3047: Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

Metrics

CVSS v3.1
8.8
Severity
HIGH
Fixed in
26.2.14-1
Affected Products
8

Fix available

26.2.14-126.2-1626.4.10-126.4-12
Affected packages
  • Red Hat / Red Hat build of Keycloak 26.2
    Fixed in 26.2.14-1
  • Red Hat / Red Hat build of Keycloak 26.2
    Fixed in 26.2-16
  • Red Hat / Red Hat build of Keycloak 26.2
    Fixed in 26.2-16
  • Red Hat / Red Hat build of Keycloak 26.2.14
  • Red Hat / Red Hat build of Keycloak 26.4
    Fixed in 26.4.10-1
  • Red Hat / Red Hat build of Keycloak 26.4
    Fixed in 26.4-12
  • Red Hat / Red Hat build of Keycloak 26.4
    Fixed in 26.4-12
  • Red Hat / Red Hat build of Keycloak 26.4.10
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References