Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Keycloak SAML Authentication Bypass Without Re-authentication

CVE-2026-3047 GHSA-8cr3-vpxx-92cx GHSA-8cr3-vpxx-92cx
Summary

Keycloak's SAML feature can be tricked into allowing unauthorized access to other applications, even if a user is not supposed to be logged in. This could let an attacker access sensitive information without needing to log in again. Update to Keycloak version 26.5.5 to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versionsFix available
keycloak org.keycloak:keycloak-broker-saml <= 1.8.1.Final –
Original title
Keycloak SAML Broken has Authentication Bypass by Primary Weakness
Original description
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

A fix is available at https://github.com/keycloak/keycloak/releases/tag/26.5.5.
nvd CVSS3.1 8.8
Vulnerability type
CWE-305
Published: 5 Mar 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026