SB2026091064 - Multiple vulnerabilities in Red Hat build of Keycloak 26.2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091064

SB2026091064 - Multiple vulnerabilities in Red Hat build of Keycloak 26.2

Published: September 10, 2026

Security Bulletin ID SB2026091064
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-3047)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass disabled SAML client restrictions and establish a realm SSO session.

The vulnerability exists due to improper enforcement of disabled client status in the SAML broker when processing IdP-initiated broker logins. A remote user can authenticate through an external identity provider to bypass disabled SAML client restrictions and establish a realm SSO session.

The disabled SAML client must be configured as an IdP-initiated broker landing target.


2) Improper access control (CVE-ID: CVE-2026-2603)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to authenticate users into the realm through a disabled SAML identity provider.

The vulnerability exists due to improper enforcement of disabled identity provider status in the SAML broker callback endpoint when processing IdP-initiated broker logins. A remote attacker can submit a SAML response through the broker callback endpoint to authenticate users into the realm through a disabled SAML identity provider.


3) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-2092)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain unauthorized access and disclose sensitive information.

The vulnerability exists due to improper validation of specified type of input in the SAML broker endpoint when processing encrypted assertions in an unsigned SAML response. A remote user can craft a malicious SAML response containing an encrypted assertion for an arbitrary principal to gain unauthorized access and disclose sensitive information.

Exploitation requires a valid signed SAML assertion.


Remediation

Install update from vendor's website.

References