CVE-2026-3047: Keycloak SAML Auth Bypass Vulnerability

CVE-2026-3047 Overview

A security flaw has been discovered in the org.keycloak.broker.saml component of Keycloak, a widely-used open source identity and access management solution. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This vulnerability allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions intended to control access through client enablement status.

Critical Impact

Attackers can bypass authentication restrictions by exploiting disabled SAML clients, gaining unauthorized SSO access to other enabled applications without proper re-authentication.

Affected Products

• Keycloak (org.keycloak.broker.saml component)
• Red Hat Single Sign-On (affected versions prior to patched releases)
• Red Hat build of Keycloak

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-3047 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3047

Vulnerability Analysis

This vulnerability is classified under CWE-305 (Authentication Bypass by Primary Weakness), indicating a fundamental flaw in how Keycloak validates client enablement status during the SAML IdP-initiated authentication flow. The core issue lies in the broker's failure to properly enforce the disabled state of SAML clients when they are configured as landing targets for IdP-initiated login flows.

Under normal operation, administrators disable SAML clients to prevent their use in authentication workflows. However, due to this vulnerability, when a disabled client is specifically configured as an IdP-initiated broker landing target, the authentication flow proceeds despite the client's disabled status. Once a session is established through the disabled client, the attacker can leverage the SSO session to access other enabled clients within the same realm without additional authentication challenges.

Root Cause

The root cause of this vulnerability is insufficient validation of the SAML client's enabled/disabled status during IdP-initiated broker authentication flows. The org.keycloak.broker.saml component fails to check whether the target client is disabled before allowing the authentication process to complete and establish an SSO session. This represents a breakdown in the expected access control logic where client enablement status should act as a gate for all authentication attempts involving that client.

Attack Vector

The attack exploits the network-accessible SAML authentication endpoints in Keycloak. An attacker with valid IdP credentials can initiate a SAML-based login flow targeting a disabled client that has been configured as an IdP-initiated broker landing target. The attack scenario proceeds as follows:

1. The attacker identifies a disabled SAML client configured as an IdP-initiated landing target
2. The attacker initiates a SAML authentication request through the IdP, targeting the disabled client
3. Despite the client being disabled, Keycloak processes the authentication and establishes an SSO session
4. The attacker then uses this established SSO session to access other enabled clients in the realm without re-authentication

This attack requires the attacker to have low-level privileges (valid IdP credentials) but requires no user interaction to execute. The impact includes potential compromise of confidentiality, integrity, and availability of data accessible through the enabled clients.

Detection Methods for CVE-2026-3047

Indicators of Compromise

• Unexpected successful authentication attempts involving disabled SAML clients in Keycloak audit logs
• SSO sessions established through clients that should not be accessible due to disabled status
• Authentication events from IdP-initiated flows targeting known disabled clients
• Unusual access patterns where users access enabled clients without corresponding authentication events for those specific clients

Detection Strategies

• Review Keycloak server logs for authentication successes involving disabled SAML client identifiers
• Monitor for IdP-initiated authentication flows that reference disabled client configurations
• Implement alerting on SSO session creation events that correlate with disabled client access attempts
• Audit realm configurations to identify disabled clients configured as IdP-initiated broker landing targets

Monitoring Recommendations

• Enable detailed authentication event logging in Keycloak to capture client identifiers and flow types
• Implement log correlation between IdP authentication events and Keycloak session establishment
• Set up alerts for authentication anomalies where session access patterns don't match expected client authentication flows
• Regularly audit SAML client configurations to ensure disabled clients are not configured as broker landing targets

How to Mitigate CVE-2026-3047

Immediate Actions Required

• Review all SAML client configurations to identify disabled clients configured as IdP-initiated broker landing targets
• Remove or reconfigure disabled SAML clients from IdP-initiated broker landing target configurations
• Apply the latest security patches from Red Hat as outlined in the security advisories
• Monitor authentication logs for any evidence of exploitation attempts

Patch Information

Red Hat has released security advisories addressing this vulnerability. Organizations using affected Keycloak deployments should apply the appropriate patches:

• Red Hat Security Advisory RHSA-2026:3925
• Red Hat Security Advisory RHSA-2026:3926
• Red Hat Security Advisory RHSA-2026:3947
• Red Hat Security Advisory RHSA-2026:3948

For additional technical details, refer to the Red Hat CVE-2026-3047 Reference and Red Hat Bug Report #2441966.

Workarounds

• Ensure all disabled SAML clients are removed from IdP-initiated broker landing target configurations until patches can be applied
• Implement network-level access controls to restrict access to SAML authentication endpoints to trusted sources
• Consider temporarily enabling clients that require IdP-initiated flows and applying additional access controls rather than relying on the disabled state
• Deploy monitoring and alerting to detect exploitation attempts while awaiting patch deployment

# Example: Audit Keycloak configuration for disabled SAML clients
# Review realm export to identify disabled clients with IdP-initiated configurations
kcadm.sh get clients -r your-realm --fields id,clientId,enabled,protocol \
  | grep -A2 '"enabled" : false' \
  | grep -B1 '"protocol" : "saml"'