CVE-2026-3047 - Vulnerability Analysis

Overview

Keycloak contains a broken access control vulnerability caused by disabled SAML clients configured as IdP-initiated broker landing targets still completing login, letting remote attackers bypass authentication and access enabled clients.

Severity & Score

Impact

Remote attackers can bypass authentication and gain unauthorized access to enabled clients, compromising security.

Mitigation

Update to the latest version of Keycloak containing the fix.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2441966
• https://access.redhat.com/errata/RHSA-2026:3925
• https://access.redhat.com/errata/RHSA-2026:3926
• https://access.redhat.com/errata/RHSA-2026:3947
• https://access.redhat.com/errata/RHSA-2026:3948
• https://access.redhat.com/security/cve/CVE-2026-3047

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 5, 2026

🟠 CVE-2026-3047 - High (8.8) A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Sin... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3047/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner