CVE-2026-2603CWE-306

CVE-2026-2603

High · published March 18, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
54.5
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00750 · 54.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-18T06:16Z
Affected products (2)
ProductVersionsFixed in
redhat/build_of_keycloak≥ 26.2, < 26.2.1426.2.14
redhat/build_of_keycloak≥ 26.4, < 26.4.1026.4.10
References (14)
https://access.redhat.com/errata/RHSA-2026:3925 · [email protected]https://access.redhat.com/errata/RHSA-2026:3926 · [email protected]https://access.redhat.com/errata/RHSA-2026:3947 · [email protected]https://access.redhat.com/errata/RHSA-2026:3948 · [email protected]https://access.redhat.com/security/cve/CVE-2026-2603 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2440300 · [email protected]https://access.redhat.com/errata/RHSA-2026:3925 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:3926 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:3947 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:3948 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-2603 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2440300 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2440300 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2603.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 18 MAR 01:14Z
    Keycloak: keycloak: unauthorized authentication via disabled saml identity provider
    cvelistv5