Keycloak SAML Identity Provider Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in Keycloak. A remote attacker can exploit this flaw by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint designated for IdP-initiated broker logins. This exploitation allows the attacker to bypass security controls and complete broker logins, even when the SAML Identity Provider is disabled, resulting in unauthorized authentication.

Impact

Exploiting this vulnerability allows for unauthorized authentication through disabled SAML Identity Providers via IdP-initiated broker logins.

Reproduction

To reproduce this vulnerability, target a Keycloak instance with a disabled SAML Identity Provider. Generate a valid SAML response from an external IdP and send it to the Keycloak SAML endpoint for IdP-initiated broker logins.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.2.14 or 26.4.10, both of which include a fix for this vulnerability.