What is the CVSS score of CVE-2026-3047?

CVE-2026-3047 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Build Of Keycloak are affected by CVE-2026-3047?

A critical authentication bypass vulnerability in Keycloak allows attackers to establish unauthorized SSO sessions by exploiting disabled SAML identity providers, potentially compromising user access…. A patch is available.

How to fix or mitigate CVE-2026-3047?

Within 24 hours: Audit all SAML identity provider configurations in Keycloak to identify disabled clients configured as IdP-initiated broker landing targets; disable or remove these configurations immediately. Within 7 days: Implement monitoring and logging for SAML authentication requests to detect exploitation attempts; conduct access reviews to identify suspicious SSO sessions established since vulnerability disclosure. Within 30 days: Evaluate upgrade path to patched Keycloak version when available; deploy additional identity verification controls for sensitive applications; conduct security awareness training on federated identity risks.

Build Of Keycloak CVE-2026-3047

HIGH

Authentication Bypass by Primary Weakness (CWE-305)

2026-03-05 secalert@redhat.com

GHSA-8cr3-vpxx-92cx

Authentication Bypass Build Of Keycloak Keycloak

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.keycloak:keycloak-broker-saml (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 1.8.1.Final.

DescriptionCVE.org

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

AnalysisAI

Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowing attackers with valid credentials to establish authenticated sessions and access other enabled clients without re-authentication. An authenticated remote attacker can exploit this authentication bypass to gain unauthorized access to protected resources across the Keycloak ecosystem. No patch is currently available.