Bug 2440300 (CVE-2026-2603)

Summary:	CVE-2026-2603 keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aschwart, boliveir, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-03-01

Description OSIDB Bzimport 2026-02-16 21:18:59 UTC

Summary:
A SAML Identity Provider that is disabled in the broker realm can still complete IdP‑initiated broker logins

Requirements to exploit:

The SAML protocol endpoint must be reachable
Attacker needs to know the URL assigned to the broker in Keycloak for IDP initiated
Attacker needs to log in with a valid user to the external IDP via SAML to be able to send a SAML response to Keycloak
As the SAML IDP is disabled and no longer trusted, this violates C&A for Keycloak.

Steps to reproduce:

Target a Keycloak 26.5.2 instance.
Set up an IDP in Keycloak that is disabled
Generate a valid SAML response from the external IdP
Send it to the Keycloak SAML endpoint for IDP initiated broker logins