Log in Start free

Vulnerability · Published Mar 18, 2026 · Assigned by redhat

CVE-2026-2603Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

High 8.1

In plain English

A high-severity missing authentication in Red Hat build of Keycloak 26.2 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-server-spi-private26.5.5GHSA-x4p7-7chp-64hq
Mavenorg.keycloak:keycloak-services26.5.5GHSA-x4p7-7chp-64hq

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2.14 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4.10 see references

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References