CVE-2026-3047: 
Java vulnerability analysis and mitigation

CVE-2026-3047 is an authentication bypass vulnerability in Keycloak's SAML broker component (org.keycloak.broker.saml) that allows a disabled SAML client configured as an IdP-initiated broker landing target to complete the login process and establish a valid SSO session. This enables a remote attacker with low privileges to gain unauthorized access to other enabled clients without re-authentication. The vulnerability was reported on February 23, 2026, publicly disclosed on March 5, 2026, and patches were released the same day. It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-305 (Authentication Bypass by Primary Weakness). Keycloak fails to enforce the disabled state of a SAML client when it is configured as an IdP-initiated broker landing target — the broker completes the login flow and creates a realm SSO session even though the target client is marked as disabled. Two preconditions are required: (1) the Keycloak instance must have a disabled SAML client configured as an IdP-initiated broker landing target, and (2) the authenticating user must exist in the external Identity Provider. Once the SSO session is established via the disabled client, the attacker can access any other enabled client in the realm without re-authentication (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a remote attacker with low-privilege credentials to bypass Keycloak's client-level access controls and gain unauthorized access to all enabled clients within the same realm via an illegitimately established SSO session. This compromises confidentiality and integrity of federated applications relying on Keycloak for authentication, and could facilitate lateral movement across services integrated with the affected Keycloak realm. Availability is also rated as high impact in the CVSS scoring, reflecting the potential for disruption to the authentication infrastructure (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify a Keycloak instance that uses SAML-based Identity Provider brokering. Determine whether any disabled SAML clients are configured as IdP-initiated broker landing targets (this may require low-privilege access to the Keycloak admin console or knowledge of the realm configuration).
2. Obtain external IdP credentials: Acquire valid credentials for a user that exists in the external Identity Provider federated with the target Keycloak realm.
3. Initiate IdP-initiated SAML login: Trigger an IdP-initiated SAML login flow targeting the disabled SAML client as the landing target. This involves sending a SAML response from the external IdP directed at the Keycloak broker endpoint associated with the disabled client.
4. Bypass client-disabled check: Due to the flaw in org.keycloak.broker.saml, Keycloak processes the SAML assertion and completes the login flow without enforcing the disabled state of the target client, creating a valid realm SSO session.
5. Access enabled clients: Use the established SSO session to access other enabled clients within the Keycloak realm without re-authentication, effectively bypassing access controls (Red Hat Bugzilla, Red Hat CVE).

• Logs: Keycloak audit/event logs showing successful login events (LOGIN event type) associated with a SAML client that is marked as disabled in the realm configuration; SSO session creation events (LOGIN) for users whose only entry point should have been a disabled client.
• Logs: Keycloak logs showing IdP-initiated SAML broker flows completing for disabled client IDs, particularly entries in keycloak server logs referencing IdentityBrokerService or org.keycloak.broker.saml with unexpected session establishment.
• Network: Unexpected SAML POST or Redirect binding requests to Keycloak's broker endpoint (e.g., /auth/realms/{realm}/broker/{provider}/endpoint) originating from external IdP sources for accounts that should not have active sessions.
• Logs: Subsequent access tokens or authorization codes issued to enabled clients immediately following an IdP-initiated SAML login for a user with no prior active session, without a corresponding re-authentication event.

Red Hat has released patches addressing CVE-2026-3047 in the following advisories: RHSA-2026:3925 (Red Hat build of Keycloak 26.2.14 images), RHSA-2026:3926 (Red Hat build of Keycloak 26.2.14 packages), RHSA-2026:3947 (Red Hat build of Keycloak 26.4.10 packages), and RHSA-2026:3948 (Red Hat build of Keycloak 26.4.10 images for OpenShift). Organizations should upgrade to Keycloak 26.2.14 or 26.4.10 as the primary remediation. As a workaround, administrators should audit all SAML clients configured as IdP-initiated broker landing targets and ensure no disabled clients are assigned this role; additionally, implement network-level access controls to restrict SAML broker authentication flows and audit existing SSO sessions for anomalous access patterns (RHSA-2026:3947, RHSA-2026:3925, RHSA-2026:3948).

The Hacker Wire published a dedicated article on the vulnerability titled "Keycloak SAML Disabled Client SSO Bypass," highlighting the authentication bypass risk for organizations using Keycloak's SAML brokering features (The Hacker Wire). The vulnerability was also noted in Java community roundups, including InfoQ's Java News Roundup for early March 2026, reflecting broader developer awareness of the Keycloak security release. Community reaction has been measured, with no significant controversy or widespread alarm, consistent with the absence of active exploitation.