Two authentication bypass vulnerabilities have been patched in Keycloak, the widely deployed open-source identity and access management platform maintained by Red Hat. The issues, tracked as CVE-2026-3009 and CVE-2026-3047, both allow authentication to complete via identity providers or SAML clients that an administrator has explicitly disabled. Both issues are addressed in Keycloak 26.5.5, released in early March 2026.
Vulnerability Details
CVE-2026-3009 affects the IdentityBrokerService.performLogin endpoint. When a user attempts to authenticate via a federated identity provider, Keycloak fails to enforce the enabled or disabled state of that IdP. An attacker or user can complete a login flow through an IdP that an administrator has explicitly decommissioned or disabled, bypassing the intended revocation of trust for that identity source. This is particularly dangerous in scenarios where an IdP was disabled specifically to cut off access for a group of users or to revoke a compromised integration.
CVE-2026-3047 targets the SAML broker flow. When a SAML client is configured as an IdP-initiated broker and that client has been disabled, authentication can still proceed to completion. The flaw means that disabling a SAML client does not reliably terminate its ability to serve as an authentication entry point, undermining administrative access control decisions.
Both vulnerabilities share the same structural root cause: Keycloak's authentication broker logic does not consistently check the enabled status of the relevant IdP or client at the point where authentication is permitted to complete. This is a logic enforcement failure rather than a cryptographic or protocol flaw.
Why This Matters for Zero Trust Architectures
Keycloak is a core identity layer in many enterprise and cloud-native environments, commonly used to broker SSO across dozens or hundreds of downstream applications. In zero trust deployments, the ability to disable an IdP or client is a critical administrative control: it is used to respond to compromised integrations, enforce offboarding, or gate access during incidents. CVE-2026-3009 and CVE-2026-3047 both undermine this control, meaning that a disabled IdP or SAML client cannot be reliably relied upon to deny access. It is worth noting that these CVEs are part of a broader pattern in recent Keycloak releases: the same 26.5.5 release also addresses CVE-2026-2603 (disabled SAML IdP still allows IdP-initiated broker login) and CVE-2026-2092 (SAML broker encrypted assertion injection), indicating that the broker and SAML authentication paths have been a sustained focus of security review.
Affected Versions and Remediation
Both CVEs are fixed in Keycloak 26.5.5. Organizations running earlier versions of the 26.x branch should upgrade immediately. Administrators should also audit their IdP and SAML client configurations to confirm that disabled entries are functioning as intended after upgrading, and review recent authentication logs for unexpected logins via IdPs or clients that were believed to be inactive.
This article is published for threat intelligence purposes. IntelFusions is not affiliated with any threat actor group. Claims described herein have not been independently verified unless explicitly stated.