Identity CVE · SAML
CVE-2026-2603Keycloak accepts SAML from a disabled identity provider
high
What broke
Keycloak still accepted a valid SAML response from an external IdP after an administrator disabled that SAML identity provider. A remote attacker who can present a previously valid (or still-signable) assertion completes a broker login. High. Red Hat / Keycloak patched. CVE-2026-3047 is a related disabled-client landing-target issue on IdP-initiated broker flows.
Why it matters
"Disabled" is how you contain a compromised or decommissioned partner IdP. If the ACS still honors the old signature, disable is theater. Same class as First Broker Login and the 2024 Keycloak SAML signature bug: broker edges keep failing closed.
What to do
- Upgrade Keycloak. After the upgrade, disable is not enough: remove the IdP or rotate its signing key.
- Hunt broker logins whose IdP alias is marked disabled.
- Read the SAML protocol page before you brief this as a one-off.
Sources
- NVD: CVE-2026-2603
- GitHub GHSA-x4p7-7chp-64hq
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.