CVE-2026-2603

HighCVSS 8.1/10Last modified Aug 18, 2026

Description

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2.14—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4.10—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2—
Red HatRed Hat build of Keycloak 26.2.14—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4.10—

References

Timeline

Published
Mar 18, 2026
Last modified
Aug 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-260309.9Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specificallyCVE-2026-260315.3Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was iCVE-2026-260325.4The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. CVE-2026-260338.4UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) vulnerability, which CVE-2026-260348.5UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that alloCVE-2026-260359.8An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, ForCVE-2026-26045.6A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with DCVE-2026-260457.2A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during proceCVE-2026-260467.2A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow cCVE-2026-260476.5A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execCVE-2026-260487.5The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthenticaCVE-2026-260495.7The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to a
CVE-2026-2603: High severity, CVSS 8.1 | Vulnix