CVE-2026-3047: Keycloak SAML Authentication Bypass Vulnerability
Summary
CVE-2026-3047: Keycloak SAML Broken has Authentication Bypass by Primary Weakness. Affects org.keycloak:keycloak-broker-saml versions < 1.8.1.Final. No fix is published. How to fix ↓
Also tracked for
- keycloak · Bitnami
The same CVE-2026-3047 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows applications to secure their services with minimal effort. It supports various authentication protocols, including SAML (Security Assertion Markup Language), which is widely used for Single Sign-On (SSO) capabilities. The Keycloak SAML broker enables integration with external identity providers, allowing users to authenticate using their existing credentials. However, a flaw has been identified in the SAML broker that can lead to serious security implications.
Vulnerability Detail
A flaw was found in the org.keycloak.broker.saml package, where a disabled SAML client configured as an Identity Provider (IdP)-initiated broker landing target can still complete the login process. This vulnerability allows a remote attacker to gain unauthorized access to other enabled clients without requiring re-authentication, effectively bypassing security restrictions. The vulnerability is classified under CWE-305, which pertains to improper access control, and has a CVSS score of 8.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that disabled SAML clients are not configured as IdP-initiated broker landing targets. This can help mitigate the risk until the package is updated to the patched version.
Conclusion
The Keycloak SAML authentication bypass vulnerability (CVE-2026-3047) poses a significant risk by allowing unauthorized access to clients. It is crucial to update to the patched version (26.5.5) to mitigate this risk. Implementing the suggested workaround can provide temporary relief until the update is applied.
See every vulnerability recorded for org.keycloak:keycloak-broker-saml →
FAQ
The vulnerability allows unauthorized access to enabled clients without re-authentication, potentially compromising sensitive data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Implement the workaround by ensuring that disabled SAML clients are not set as IdP-initiated broker landing targets.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can visit the official Keycloak documentation and GitHub repository for more details on its features and updates.
