Keycloak SAML Broken has Authentication Bypass by Primary Weakness

The impact of CVE-2026-3047 is significant, as it enables unauthorized access to Keycloak clients. An attacker can exploit this vulnerability by configuring a disabled SAML client as an IdP-initiated broker landing target. By successfully completing the login process through this disabled client, the attacker can establish an SSO session and gain access to other enabled clients within the Keycloak realm, effectively bypassing authentication. This could lead to data breaches, privilege escalation, and potential compromise of the entire Keycloak instance, depending on the permissions granted to the affected clients. The ability to bypass authentication without re-authentication significantly lowers the barrier to entry for attackers.

Organizations using Keycloak as an identity provider and relying on SAML-based authentication are at risk. Specifically, deployments with disabled SAML clients configured as IdP-initiated broker landing targets are particularly vulnerable. Shared hosting environments where multiple Keycloak instances share resources could also be affected if proper isolation measures are not in place.

• java / server:

# Check Keycloak version
java -jar keycloak.jar --version

• java / server:

# Review Keycloak logs for unusual login attempts or access to disabled SAML clients
grep -i 'disabled saml client' /path/to/keycloak/logs/keycloak.log

• java / server:

# Inspect Keycloak configuration for IdP-initiated SSO enabled on disabled clients
# (Requires access to Keycloak admin console or configuration files)

1. 2026-03-05Disclosure

   disclosure

1. 予約済み2026-02-23
2. 公開日2026-03-05
3. 更新日2026-03-06
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-3047 is to upgrade Keycloak to version 26.5.5 or later, which contains the fix. If an immediate upgrade is not feasible, consider disabling IdP-initiated SSO for disabled SAML clients as a temporary workaround. Review your Keycloak configuration to ensure that disabled clients are not inadvertently used as broker landing targets. Monitor Keycloak logs for any unusual login activity or attempts to access disabled clients. After upgrading, confirm the fix by attempting to initiate an SSO session through a previously disabled SAML client and verifying that access is denied.