Keycloak: Unauthorized authentication via disabled SAML Identity Provider

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-2603 · ADVISORY
• keycloak/keycloak · WEB
• keycloak/keycloak#46932 · WEB
• keycloak/keycloak commit 4fd5367 · WEB
• keycloak/keycloak commit 8ed7e59 · WEB
• access.redhat.com/errata/RHSA-2026:3925 · WEB
• access.redhat.com/errata/RHSA-2026:3926 · WEB
• access.redhat.com/errata/RHSA-2026:3947 · WEB
• access.redhat.com/errata/RHSA-2026:3948 · WEB
• access.redhat.com/security/cve/CVE-2026-2603 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• keycloak/keycloak · PACKAGE
• keycloak/keycloak · WEB
• security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2603.json · Vendor Advisory

org.keycloak:keycloak-server-spi-private のその他の脆弱性

• CVE-2026-9791中 4.3A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing API…
• CVE-2026-9704高 8.8A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token…
• CVE-2026-3190中 4.3A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_pro…
• CVE-2026-0871中 4.9A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unma…
• CVE-2023-2585高 8.1Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing …