# CVE-2026-3047: Keycloak SAML broker authentication bypass via disabled client

Source: https://junglewise.ai/threats/cve-2026-3047-keycloak-saml-broker-authentication-bypass-via-disabled-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-3047 · Severity: high · CVSS 8.8 · Published 2026-03-05

A security flaw has been identified in Keycloak, a popular open-source identity and access management solution. The vulnerability allows a user to log in through a disabled SAML client if it is configured as a landing target for identity provider logins. Once logged in, an attacker could gain unauthorized access to other active applications and services within the same single sign-on (SSO) environment without needing to re-authenticate.

Technologies: [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-3047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3047 being exploited in the wild.

**How severe is CVE-2026-3047?** High severity, with a CVSS score of 8.8, published 5 March 2026.

**Which products and versions are affected?** org.keycloak:keycloak-broker-saml (Maven) ECOSYSTEM:introduced=0,last_affected=1.8.1.Final; Red Hat build of Keycloak 26.2, 26.4.

**Is there a fix for CVE-2026-3047?** A patch was published on 2026-03-05: Fixed in Red Hat build of Keycloak 26.2.14 and 26.4.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3047 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3047?** Check whether you run org.keycloak:keycloak-broker-saml (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the org.keycloak.broker.saml component of Keycloak. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, the system fails to properly enforce the disabled status during the authentication flow. This allows a remote attacker with low privileges to complete the login process and establish a valid Single Sign-On (SSO) session. Consequently, the attacker can access other enabled clients within the realm without further authentication. Red Hat has released security advisories (RHSA-2026:3925, RHSA-2026:3926, RHSA-2026:3947, RHSA-2026:3948) to address this issue in Keycloak versions 26.2.14 and 26.4.10.

## Affected products

- Red Hat Red Hat build of Keycloak 26.2, 26.4

## Identifiers

- CVE-2026-3047
- GHSA-8cr3-vpxx-92cx

## Timeline

- 2026-03-05: disclosed
- 2026-03-05: patched: Fixed in Red Hat build of Keycloak 26.2.14 and 26.4.10

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:3925](https://access.redhat.com/errata/RHSA-2026:3925)
- [https://access.redhat.com/errata/RHSA-2026:3926](https://access.redhat.com/errata/RHSA-2026:3926)
- [https://access.redhat.com/errata/RHSA-2026:3947](https://access.redhat.com/errata/RHSA-2026:3947)
- [https://access.redhat.com/errata/RHSA-2026:3948](https://access.redhat.com/errata/RHSA-2026:3948)
- [https://access.redhat.com/security/cve/CVE-2026-3047](https://access.redhat.com/security/cve/CVE-2026-3047)

## Related threats

- [Keycloak SAML HTTP Parameter Pollution in HTTP-Redirect binding](https://junglewise.ai/threats/cve-2026-18217-keycloak-saml-http-parameter-pollution-in-http-redirect-binding)
- [Keycloak keycloak-services improper wildcard domain validation in client policies](https://junglewise.ai/threats/cve-2026-18206-keycloak-keycloak-services-improper-wildcard-domain-validation-in)
- [Keycloak keycloak-services authorization bypass in role-users endpoint](https://junglewise.ai/threats/cve-2026-17059-keycloak-keycloak-services-authorization-bypass-in-role-users)
- [Red Hat Keycloak authorization bypass in FGAP v2 child group endpoint](https://junglewise.ai/threats/cve-2026-14615-red-hat-keycloak-authorization-bypass-in-fgap-v2-child-group)
- [Keycloak privilege escalation in Identity Provider mapper](https://junglewise.ai/threats/cve-2026-12388-keycloak-privilege-escalation-in-identity-provider-mapper)