Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-3047

Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2.14-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-16 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-16 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2.14

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.10-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-12 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-12 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.10

Default version status: unaffected

References