CVE-2026-3047

CVE-2026-3047 describes a critical vulnerability in Keycloak's SAML broker functionality, where a disabled SAML client configured as an Identity Provider (IdP)-initiated broker landing target can still complete the login process and establish a Single Sign-On (SSO) session. This flaw allows a remote attacker to bypass authentication and gain unauthorized access to other enabled clients. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness among security professionals.