CVE-2026-3047

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:3925	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3926	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3947	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3948	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-3047	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2441966	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:build_of_keycloak:-::::text-only:::
	cpe:2.3:a:redhat:build_of_keycloak:26.2:::::::*
	cpe:2.3:a:redhat:build_of_keycloak:26.2.14:::::::*
	cpe:2.3:a:redhat:build_of_keycloak:26.4:::::::*
	cpe:2.3:a:redhat:build_of_keycloak:26.4.10:::::::*
	cpe:2.3:a:redhat:keycloak:-:::::::*

History

No history.

Information

Published : 2026-03-05 19:16

Updated : 2026-03-26 14:20

NVD link : CVE-2026-3047

Mitre link : CVE-2026-3047

CVE.ORG link : CVE-2026-3047

JSON object : View

Products Affected

redhat

build_of_keycloak
keycloak

CWE

CWE-305

Authentication Bypass by Primary Weakness

{"id": "CVE-2026-3047", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-03-05T19:16:18.383", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:3925", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:3926", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:3947", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:3948", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-3047", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441966", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-305"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en org.keycloak.broker.saml. Cuando un cliente de Security Assertion Markup Language (SAML) deshabilitado se configura como un objetivo de aterrizaje de intermediario iniciado por un Proveedor de Identidad (IdP), a\u00fan puede completar el proceso de inicio de sesi\u00f3n y establecer una sesi\u00f3n de Single Sign-On (SSO). Esto permite a un atacante remoto obtener acceso no autorizado a otros clientes habilitados sin re-autenticaci\u00f3n, eludiendo eficazmente las restricciones de seguridad."}], "lastModified": "2026-03-26T14:20:02.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*", "vulnerable": true, "matchCriteriaId": "1830E455-7E11-4264-862D-05971A42D4A6"}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:26.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBB531B3-5BD6-41B4-882C-A42F611819B9"}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:26.2.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56732D81-7096-40F3-A990-1C84E2D984F2"}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:26.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C8F3485-92CB-4F23-A35A-AAA444FDF39E"}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:26.4.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8A55A00-BD52-4198-B43A-62919C272AA8"}, {"criteria": "cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E0DE4E1-5D8D-40F3-8AC8-C7F736966158"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}