BIT-keycloak-2026-3047: Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when a disabled SAML client is configured as the landing target for an IdP-initiated broker login. The issue affects access to other enabled clients that rely on the resulting SSO session.
What does an attacker need to exploit it?
The attacker can exploit the issue remotely through the IdP-initiated SAML broker login flow. The supplied CVSS vector indicates low privileges are required and no user interaction is required.
Does disabling the SAML client prevent the login flow?
No. Under the affected configuration, a disabled SAML client can still complete the IdP-initiated login process and establish an SSO session, allowing access to enabled clients without re-authentication.