Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-2603

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2.14-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-16 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-16 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2.14

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.10-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-12 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-12 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.10

Default version status: unaffected

References