{"id":"CVE-2026-3047","aliases":["BIT-keycloak-2026-3047","EUVD-2026-9864","GHSA-8cr3-vpxx-92cx"],"status":"published","title":"Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00545,"percentile":0.46174,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-305"],"published":"2026-03-05T18:28:36Z","modified":"2026-11-06T10:46:32Z","fixes":[{"ecosystem":"Bitnami","package":"keycloak","fixed_in":["26.2.1","26.3.0","26.4.1","26.5.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-broker-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.1.Final"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keycloak","ranges":[{"type":"SEMVER","events":[{"introduced":"26.2.0"},{"fixed":"26.2.1"},{"introduced":"26.2.14"},{"fixed":"26.3.0"},{"introduced":"26.4.0"},{"fixed":"26.4.1"},{"introduced":"26.4.10"},{"fixed":"26.5.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-broker-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.1.Final"}]}],"versions":["1.2.0.Beta1","1.2.0.CR1","1.2.0.Final","1.3.0.Final","1.3.1.Final","1.4.0.Final","1.5.0-Final","1.5.0.Final","1.5.1.Final","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.Final","1.8.0.Alpha1","1.8.0.CR1","1.8.0.CR2","1.8.0.CR3","1.8.0.Final","1.8.1.Final"]}],"products":[{"vendor":"red hat","product":"red hat build of keycloak 26.2"},{"vendor":"red hat","product":"red hat build of keycloak 26.2.14"},{"vendor":"red hat","product":"red hat build of keycloak 26.4"},{"vendor":"red hat","product":"red hat build of keycloak 26.4.10"},{"vendor":"redhat","product":"build_of_keycloak"},{"vendor":"redhat","product":"keycloak"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:3925","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3926","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3947","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3948","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3047","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441966","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","advisory","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3047.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3047","tags":["web","advisory"]},{"url":"https://github.com/keycloak/keycloak/releases/tag/26.5.5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8cr3-vpxx-92cx"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3047.json","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-3047","title":"Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.","status":"published","published":"2026-03-05T18:28:36.337Z","modified":"2026-07-15T01:09:59.742Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-305","CWE-305"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-9864","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.","status":"published","published":"2026-03-05T18:28:36Z","modified":"2026-07-15T01:09:59Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:55.842782Z"}],"ghsa":[{"id":"GHSA-8cr3-vpxx-92cx","title":"Keycloak SAML Broken has Authentication Bypass by Primary Weakness","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.\n\nA fix is available at https://github.com/keycloak/keycloak/releases/tag/26.5.5.","status":"published","published":"2026-03-05T21:30:48Z","modified":"2026-03-06T22:32:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:39:32.329372Z"}],"nvd":[{"id":"CVE-2026-3047","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.","status":"published","published":"2026-03-05T19:16:18.383Z","modified":"2026-07-15T02:20:56.26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:12:07.852448Z"}],"osv":[{"id":"CVE-2026-3047","title":"Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.","status":"published","published":"2026-03-05T18:28:36.337Z","modified":"2026-11-06T10:46:32.742693791Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-305"],"updated_at":"2026-11-06T11:08:50.716036Z"},{"id":"GHSA-8cr3-vpxx-92cx","title":"Keycloak SAML Broken has Authentication Bypass by Primary Weakness","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.\n\nA fix is available at https://github.com/keycloak/keycloak/releases/tag/26.5.5.","status":"published","published":"2026-03-05T21:30:48Z","modified":"2026-08-26T01:11:25.350402102Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"BIT-keycloak-2026-3047","title":"Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login","description":"A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.","status":"published","published":"2026-08-25T11:42:14.552Z","modified":"2026-09-08T08:48:06.689597625Z","updated_at":"2026-11-02T15:28:32.162822Z"}]}}