CVE-2026-2603

Published Mar 17, 2026·Updated Aug 18, 2026

NVD Description

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Public Exploits & PoCs1 found

[POC] GHSA-3mgp-fx93-9xv5 — sk-cve-2026-26030-lab

Ethical, network-isolated Docker lab reproducing CVE-2026-26030 — Semantic Kernel in-memory vector store filter eval() RCE (patched in 1.39.4)

Community Discussion

Hacker News

AST-filtered eval() is not a sandbox: Severity 10 CVE-2026-26030, and others

beagle3

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free