← CVE Intelligence

CVE-2026-3047

Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login PUBLISHED

Description (CNA)

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2.14-1 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-16 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-16 before *
Red Hat / Red Hat build of Keycloak 26.2.14unaffected
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.10-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-12 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-12 before *
Red Hat / Red Hat build of Keycloak 26.4.10unaffected

CWE

CWE-305

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.