NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

Keycloak: Unauthorized authentication via disabled SAML Identity ProviderGHSA-x4p7-7chp-64hq

HIGHFix: keycloak/keycloak#46932

GHSA-x4p7-7chp-64hq is a high-severity (CVSS 8.1) Missing Authentication vulnerability in org.keycloak:keycloak-services. A fix is available for org.keycloak:keycloak-services — see the affected versions and patch details below.

Also known asBIT-keycloak-2026-2603CVE-2026-2603
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for GHSA-x4p7-7chp-64hq.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk+0.01%
Lower risk than most CVEs39th percentile — riskier than 39% of all scored CVEsHighest risk
0.00%0.41%0.81%1.22%0.2%0.5%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
☕org.keycloak:keycloak-services☕org.keycloak:keycloak-server-spi-private

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.keycloak:keycloak-servicesall versions26.5.5org.keycloak:keycloak-services:26.5.5
☕Mavenorg.keycloak:keycloak-server-spi-privateall versions26.5.5org.keycloak:keycloak-server-spi-private:26.5.5

Affected Products

1 product · 2 configurations
Application
build of keycloakredhat
≥ 26.4 && < 26.4.10
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.keycloak:keycloak-services, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.keycloak:keycloak-services to 26.5.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x4p7-7chp-64hq is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This important flaw in Red Hat Build of Keycloak allows a remote attacker to bypass security controls. A disabled SAML Identity Provider can still be exploited for unauthorized authentication via IdP-initiated broker logins if the SAML protocol endpoint is reachable and the attacker knows the broker URL.

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: Red Hat security advisory for GHSA-x4p7-7chp-64hq (CC BY 4.0)
ProductFixed inAdvisory
Red Hat build of Keycloak 26.2rhbk/keycloak-operator-bundle:26.2.14-1RHSA-2026:3925
Red Hat build of Keycloak 26.2.14rhbk/keycloak-rhel9RHSA-2026:3926
Red Hat build of Keycloak 26.4rhbk/keycloak-operator-bundle:26.4.10-1RHSA-2026:3948
Red Hat build of Keycloak 26.4.10rhbk/keycloak-rhel9RHSA-2026:3947

Frequently Asked Questions

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
O3 Security · Impact-Aware SCA

Is GHSA-x4p7-7chp-64hq in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Keycloak: Unauthorized authentication via disabled SAML…