CVE-2026-2603
published 2026-03-18CVE-2026-2603: A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the…
PriorityP356high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.44%
38.1th percentile
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.2 < 26.2.14 | 26.2.14 |
| redhat | build_of_keycloak | >= 26.4 < 26.4.10 | 26.4.10 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider
vendor_redhat·2026-03-05·CVSS 8.1
CVE-2026-2603 [HIGH] CWE-306 keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider
keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
OSV
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
osv·2026-03-18
CVE-2026-2603 [HIGH] Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
GHSA
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
ghsa·2026-03-18
CVE-2026-2603 [HIGH] CWE-306 Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2026:3925https://access.redhat.com/errata/RHSA-2026:3926https://access.redhat.com/errata/RHSA-2026:3947https://access.redhat.com/errata/RHSA-2026:3948https://access.redhat.com/security/cve/CVE-2026-2603https://bugzilla.redhat.com/show_bug.cgi?id=2440300https://access.redhat.com/errata/RHSA-2026:3925https://access.redhat.com/errata/RHSA-2026:3926https://access.redhat.com/errata/RHSA-2026:3947https://access.redhat.com/errata/RHSA-2026:3948https://access.redhat.com/security/cve/CVE-2026-2603https://bugzilla.redhat.com/show_bug.cgi?id=2440300https://bugzilla.redhat.com/show_bug.cgi?id=2440300https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2603.json
2026-03-18
Published