CVE-2026-2603Keycloak accepts SAML from a disabled identity provider
What broke
Keycloak still accepted a valid SAML response from an external IdP after an administrator disabled that SAML identity provider. A remote attacker who can present a previously valid (or still-signable) assertion completes a broker login. High. Red Hat / Keycloak patched. CVE-2026-3047 is a related disabled-client landing-target issue on IdP-initiated broker flows.
Why it matters
"Disabled" is how you contain a compromised or decommissioned partner IdP. If the ACS still honors the old signature, disable is theater. Same class as First Broker Login and the 2024 Keycloak SAML signature bug: broker edges keep failing closed.
What to do
- Upgrade Keycloak. After the upgrade, disable is not enough: remove the IdP or rotate its signing key.
- Hunt broker logins whose IdP alias is marked disabled.
- Read the SAML protocol page before you brief this as a one-off.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
- NVD: CVE-2026-2603
- GitHub GHSA-x4p7-7chp-64hq
Related identity CVEs
Related on Start with Identity
- CVEKeycloak SAML broker assertion replay, session hijack
Keycloak's SAML broker accepted a replayed assertion and hijacked a user session. An authentication bypass on the broker edge. Patched in the 2026 Keycloak SAML
- CVEKeycloak SAML POST-binding XSS via ACS URL
The SAML POST-binding flow reflected a crafted Assertion Consumer Service URL as script. An XSS on the IdP login path is session theft. Patched with the April 2
- CVEKeycloak Admin API auth bypass to custom attributes
Keycloak's Admin API let a caller read sensitive custom attributes they should not have seen (CWE-266). An authorization hole on the admin plane.
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si