CVE-2026-3047
Published: 05 March 2026
Description
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This…
more
allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.
Mitigating Controls (NIST 800-53 r5)AI
Timely application of vendor patches, such as RHSA-2026:3925, directly remediates the flaw in Keycloak's SAML broker allowing disabled clients to establish unauthorized SSO sessions.
Enforces access control policies to restrict login and SSO session establishment to only enabled clients, preventing the bypass of security restrictions on disabled SAML clients.
Manages client accounts by disabling unused or restricted SAML clients and reviewing configurations to avoid their use as IdP-initiated broker landing targets.
Security SummaryAI
CVE-2026-3047 is a high-severity vulnerability (CVSS 8.8) in the org.keycloak.broker.saml component of Keycloak, an open-source identity and access management solution. The flaw occurs when a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target. In this scenario, the disabled client can still complete the login process and establish a Single Sign-On (SSO) session, bypassing intended security restrictions (CWE-305: Improper Restriction of Communication Channel to Intended Endpoints).
A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). By targeting the misconfigured disabled SAML client, the attacker can establish an unauthorized SSO session, gaining access to other enabled clients without re-authentication. This results in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), allowing privilege escalation and unauthorized access within the Keycloak environment.
Red Hat has released multiple errata addressing this issue in their Keycloak distributions, including RHSA-2026:3925, RHSA-2026:3926, RHSA-2026:3947, and RHSA-2026:3948. Security practitioners should consult the detailed advisory at https://access.redhat.com/security/cve/CVE-2026-3047 and apply the corresponding patches to mitigate the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote exploitation of a Keycloak SAML broker service (T1210) to bypass authentication restrictions and achieve privilege escalation via unauthorized SSO session establishment (T1068).