Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-2603 Details

Description

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHSA-2026:3925 redhat-SADPVendor Advisory
https://access.redhat.com/errata/RHSA-2026:3926 redhat-SADPVendor Advisory
https://access.redhat.com/errata/RHSA-2026:3947 redhat-SADPVendor Advisory
https://access.redhat.com/errata/RHSA-2026:3948 redhat-SADPVendor Advisory
https://access.redhat.com/security/cve/CVE-2026-2603 redhat-SADPVendor Advisory

see all 14 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-306Missing Authentication for Critical Functionredhat-SADP
CWE-306Missing Authentication for Critical Function[email protected]

Affected Products

ProductVersions
redhat build of keycloak
>= 26.2, < 26.2.14
>= 26.4, < 26.4.10

CPE

  • cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-2603
NVD Published Date:
Mar 18, 2026
NVD Last Modified:
Aug 18, 2026
Source:
[email protected]
CVE-2026-2603 Details - Not Deferred