VDB
CVE-2026-2603
CVE-2026-2603
PUBLISHED
CVSS 8.100000381469727 HIGH
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
EPSS 0.23% · 45.5th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.23%
45.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2.14 | |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.14-1, 26.2.14-1, 26.2.14-1 |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-12, 26.4-12, 26.4-12 |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-16, 26.2-16, 26.2-16 |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-12, 26.4-12, 26.4-12 |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-16, 26.2-16, 26.2-16 |
| Maven | org.keycloak:keycloak-server-spi-private | 0, 0, 0 |
| Red Hat | Red Hat build of Keycloak 26.4.10 | |
| Maven | org.keycloak:keycloak-services | 0, 0, 0 |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.10-1, 26.4.10-1, 26.4.10-1 |
Timeline
- Mar 18, 2026 CVE Published
- Mar 18, 2026 EPSS Score
- Mar 18, 2026 PoC Published
- Mar 19, 2026 EPSS Score
- Mar 19, 2026 Distribution Patch
- Mar 19, 2026 Distribution Patch
- Mar 19, 2026 Distribution Patch
- Mar 19, 2026 Distribution Patch
- Mar 19, 2026 Security Advisory
- Mar 19, 2026 Security Advisory
- Mar 19, 2026 Security Advisory
- Mar 19, 2026 Security Advisory
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2440300 url
- RHSA-2026:3925 vendor-advisory
- RHSA-2026:3926 vendor-advisory
- RHSA-2026:3947 vendor-advisory
- RHSA-2026:3948 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-2603 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2026-2603 advisory
- https://github.com/keycloak/keycloak/issues/46911 url
- https://github.com/keycloak/keycloak/commit/8ed7e59dc08d79751a27c23aadb590f06b43f132 url
- https://github.com/keycloak/keycloak package