CVE-2026-3047: Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.
Other sources
A SAML client marked Disabled in the broker realm still completes IdP-initiated broker login and creates a realm SSO session. Even though the target SAML client is disabled, the user gains a valid Keycloak session and can access other enabled clients without re-authentication. Requirements to exploit
The Keycloak instance must have a disabled SAML client configured as an IdP-initiated broker landing target. The user must also exist in the external IdP.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
keycloak/keycloakto a version that resolves this vulnerability.Fixed in 26.5.5 - Compensating control
If you cannot upgrade immediately, remove/avoid configuring any disabled SAML client as an IdP-initiated broker landing target, because even a disabled SAML client can still complete IdP-initiated broker login and create a realm SSO session.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3047?
The severity of CVE-2026-3047 is considered high due to the possibility of authentication bypass.
How does CVE-2026-3047 impact my Keycloak instance?
CVE-2026-3047 allows attackers to bypass authentication by exploiting a disabled SAML client's IdP-initiated login.
How do I fix CVE-2026-3047?
To fix CVE-2026-3047, ensure that no disabled SAML clients are configured to act as Identity Providers.
What versions of Keycloak are affected by CVE-2026-3047?
CVE-2026-3047 affects versions of Keycloak that utilize the org.keycloak.broker.saml component.
Is there a patch available for CVE-2026-3047?
Yes, a patch is available in the latest version of Keycloak to resolve the CVE-2026-3047 vulnerability.