Junglewise Threat Intelligence

CVE-2026-2603: Keycloak SAML broker authentication bypass via disabled Identity Provider

CVE-2026-2603 · Severity: high · CVSS 8.1 · Published 2026-03-18

Technologies: org.keycloak:keycloak-server-spi-private (Maven), Keycloak-Services, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak 26.4. Vendors: Keycloak, Maven, Red Hat.

Executive brief

A security flaw has been identified in Keycloak, a widely used identity and access management solution. An attacker can bypass security controls by sending a specially crafted login response from an external identity provider, even if that provider has been disabled by administrators. This could allow unauthorized users to gain access to protected applications and sensitive data, potentially leading to a full account takeover.

Technical details

A vulnerability classified as Missing Authentication for Critical Function (CWE-306) exists in Keycloak's SAML broker component. The root cause is an improper enforcement of the 'disabled' status for Identity Providers during IdP-initiated broker logins. A remote attacker with low privileges can exploit this by sending a valid SAML response to the Keycloak SAML endpoint, successfully completing the broker login process despite the IdP being administratively disabled. This leads to unauthorized authentication and potential privilege escalation. The issue is addressed in Red Hat build of Keycloak versions 26.2.14 and 26.4.10.

Affected products

  • Red Hat build of Keycloak 26.2 Fixed in 26.2.14-1
  • Red Hat build of Keycloak 26.4 Fixed in 26.4.10-1

Timeline

  • 2026-03-05: patched: Red Hat released security advisories RHSA-2026:3925 and RHSA-2026:3926
  • 2026-03-18: advisory: NVD published the CVE record

References

Related threats