8.1

CVE-2026-2603: redhat build_of_keycloak

CVSS: 8.1v3.1HighAnalyzed
AliasesCGA-2h82-4g85-7x6rCGA-7r7j-prg3-rfcpCGA-cw86-mr7r-vpxq
Published 18-03-2026Last modified 15-07-2026
Open JSON

Vulnerability summary

CVE-2026-2603 is a high (CVSS 8.1) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
43/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.75%
0%100%
Low · +0.32 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 18-03-2026
    PublishedVulnerability first disclosed.
  2. 15-07-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.75%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.32 pp

From 0.43% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.75%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Chainguard8 products
  • keycloak-26.3-iamguarded-compatAll versions (No fix recorded)
  • keycloak-26.4All versions (No fix recorded)
  • keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
  • keycloak-fips-26.3-iamguarded-fipsAll versions (No fix recorded)
  • keycloak-fips-26.4All versions (No fix recorded)
Org.keycloak2 products
  • keycloak-server-spi-private< 26.5.5
  • keycloak-services< 26.5.5
Wolfi2 products
  • keycloak-26.4All versions (No fix recorded)
  • keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
Redhat1 product

4 vendors · 13 products

References

14 links
Show all 14 references