SB2026060134 - Multiple vulnerabilities in Keycloak
Published: June 1, 2026 Updated: September 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-2092)
CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input
CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized access and disclose sensitive information.
The vulnerability exists due to improper validation of specified type of input in the SAML broker endpoint when processing encrypted assertions in an unsigned SAML response. A remote user can craft a malicious SAML response containing an encrypted assertion for an arbitrary principal to gain unauthorized access and disclose sensitive information.
Exploitation requires a valid signed SAML assertion.
2) Improper access control (CVE-ID: CVE-2026-3047)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass disabled SAML client restrictions and establish a realm SSO session.
The vulnerability exists due to improper enforcement of disabled client status in the SAML broker when processing IdP-initiated broker logins. A remote user can authenticate through an external identity provider to bypass disabled SAML client restrictions and establish a realm SSO session.
The disabled SAML client must be configured as an IdP-initiated broker landing target.
3) Improper access control (CVE-ID: CVE-2026-3009)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to authenticate through a disabled identity provider.
The vulnerability exists due to improper enforcement of disabled identity provider status in the IdentityBrokerService.performLogin endpoint when processing broker login requests. A remote user can submit a manually constructed request to the broker login endpoint to authenticate through a disabled identity provider.
Exploitation requires a valid session_code and tab_id obtained from a standard login attempt.
4) Improper access control (CVE-ID: CVE-2026-2603)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to authenticate users into the realm through a disabled SAML identity provider.
The vulnerability exists due to improper enforcement of disabled identity provider status in the SAML broker callback endpoint when processing IdP-initiated broker logins. A remote attacker can submit a SAML response through the broker callback endpoint to authenticate users into the realm through a disabled SAML identity provider.
Remediation
Install update from vendor's website.