A flaw was found in org.keycloak.broker.saml.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 5, 2026 · NIST NVD

   Detected

   A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypa

2. Jul 15, 2026 · NIST NVD

   Updated

   A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypa

Affected

• cpe redhat/build of keycloakversion unspecified
• cpe redhat/build of keycloak26.2
• cpe redhat/build of keycloak26.2.14
• cpe redhat/build of keycloak26.4
• cpe redhat/build of keycloak26.4.10
• cpe redhat/keycloakversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2026-3047

  A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This a

  nvd.nist.gov

References

• Vendor Advisory · access.redhat.com
• Vendor Advisory · access.redhat.com
• Vendor Advisory · access.redhat.com
• Vendor Advisory · access.redhat.com
• Vendor Advisory · access.redhat.com
• Issue Tracking · bugzilla.redhat.com