~ / search / GHSA-x4p7-7chp-64hq

GHSA-x4p7-7chp-64hq

Keycloak: Unauthorized authentication via disabled SAML Identity Provider

Source: GitHub Advisory Database (reviewed) High CVE-2026-2603

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.5.5 26.5.5
Maven org.keycloak:keycloak-server-spi-private < 26.5.5 26.5.5

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

References

External links from the advisory. They lead to third-party sites.