CVE-2026-2603: Keycloak: keycloak: unauthorized authentication via disabled saml identity provider
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
Other sources
Summary: A SAML Identity Provider that is disabled in the broker realm can still complete IdP‑initiated broker logins
Requirements to exploit:
The SAML protocol endpoint must be reachable Attacker needs to know the URL assigned to the broker in Keycloak for IDP initiated Attacker needs to log in with a valid user to the external IDP via SAML to be able to send a SAML response to Keycloak As the SAML IDP is disabled and no longer trusted, this violates C&A for Keycloak.
Steps to reproduce:
Target a Keycloak 26.5.2 instance. Set up an IDP in Keycloak that is disabled Generate a valid SAML response from the external IdP Send it to the Keycloak SAML endpoint for IDP initiated broker logins
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2603?
CVE-2026-2603 has been classified with high severity due to its potential for unauthorized access through a disabled SAML identity provider.
How do I fix CVE-2026-2603?
To fix CVE-2026-2603, update your Keycloak installation to version 26.5.6 or later where the vulnerability has been addressed.
What are the affected versions for CVE-2026-2603?
CVE-2026-2603 affects Red Hat Keycloak versions up to and including 26.5.5.
Can CVE-2026-2603 be exploited remotely?
Yes, CVE-2026-2603 can be exploited remotely by an attacker sending a valid SAML response to Keycloak's SAML endpoint.
Is user authentication compromised due to CVE-2026-2603?
Yes, CVE-2026-2603 allows unauthorized authentication, potentially compromising user authentication through disabled identity providers.