A critical authentication bypass flaw in Red Hat build of Keycloak allows attackers to establish unauthorized SSO sessions, potentially leading to full account compromise.

This flaw exists in the SAML broker component where a disabled SAML client, when used as an IdP-initiated broker landing target, incorrectly allows the completion of the login process. The attacker requires low privileges and can leverage this to gain unauthorized access to other enabled clients without proper authentication.

The ability to bypass authentication mechanisms poses a severe risk to organizational security, as it permits unauthorized access to protected applications and sensitive data. With a CVSS score of 8.8, this vulnerability is classified as High severity, indicating a significant potential for lateral movement and compromise of user identities within the SSO environment.

Immediate Action: Update the Red Hat build of Keycloak to the versions specified in the relevant security advisories, specifically 26.2.14-1 or 26.2-16 for the 26.2 branch, and 26.4.10-1 or 26.4-12 for the 26.4 branch.

Proactive Monitoring: Review authentication and SSO logs for anomalous login patterns or successful sessions originating from disabled identity providers.

Compensating Controls: Ensure that SAML client configurations are strictly audited and that unnecessary identity providers are removed or disabled at the network or application firewall level if immediate patching is not feasible.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized access across the SSO ecosystem, this vulnerability represents a significant security risk. Administrators must prioritize the application of the provided Red Hat security updates to restore the integrity of the authentication process and prevent potential session hijacking.