The flaw in Keycloak allows a remote attacker to supply a valid SAML response to the SAML endpoint for IdP-initiated broker logins. Even when the target Identity Provider is marked as disabled, the attacker can complete a broker login, effectively authenticating without authorization. This results in the attacker gaining access to resources and user accounts that should remain protected.

Red Hat builds of Keycloak 26.2 (including 26.2.14) and 26.4 (including 26.4.10) running on Red Hat Enterprise Linux 9 are affected by this vulnerability.

The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1 %, meaning real-world exploitation likelihood is low, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack requires the attacker to reach the Keycloak SAML endpoint and craft a valid SAML response, so systems exposed to the network that can accept SAML traffic are the most susceptible. No known public exploitation has been reported, but the impact is significant if exploited.