CVE-2026-3047: Keycloak SAML Broken has Authentication Bypass by Primary Weakness
(updated )
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.
A fix is available at https://github.com/keycloak/keycloak/releases/tag/26.5.5.
References
- access.redhat.com/errata/RHSA-2026:3925
- access.redhat.com/errata/RHSA-2026:3926
- access.redhat.com/errata/RHSA-2026:3947
- access.redhat.com/errata/RHSA-2026:3948
- access.redhat.com/security/cve/CVE-2026-3047
- bugzilla.redhat.com/show_bug.cgi?id=2441966
- github.com/advisories/GHSA-8cr3-vpxx-92cx
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/releases/tag/26.5.5
- nvd.nist.gov/vuln/detail/CVE-2026-3047
Code Behaviors & Features
Detect and mitigate CVE-2026-3047 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →