CVE-2026-2603

Katalog CVE

CVSS 8.1 · High EPSS 0,72%

Kerentanan Missing Authentication for Critical Function pada redhat build of keycloak. Skor CVSS 3.1 8.1 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:3925 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3926 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3947 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3948 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-2603 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2440300 exploit · issue tracking · advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2603.json advisory vendor