{"action":"Upgrade org.keycloak:keycloak-server-spi-private to 26.5.5 or later.","affected":[{"fixed":"26.5.5","introduced":"0"}],"component":"org.keycloak:keycloak-server-spi-private","cve_ids":["CVE-2026-2603"],"ecosystem":"Maven","epss":0.00441,"exploited":false,"fixed_versions":["26.5.5"],"ghsa_id":"GHSA-x4p7-7chp-64hq","id":"tcs_01M5N9HR7KS3YQ1D3FDZEMYX07","modified_at":"2026-08-26T01:11:37.453123638Z","published_at":"2026-03-18T03:32:09Z","references":["https://osv.dev/vulnerability/GHSA-x4p7-7chp-64hq","https://nvd.nist.gov/vuln/detail/CVE-2026-2603","https://github.com/keycloak/keycloak/issues/46911","https://github.com/keycloak/keycloak/pull/46932","https://github.com/keycloak/keycloak/commit/4fd5367e6cc28cfa68fb2240fc459c12b1fdbf2a","https://github.com/keycloak/keycloak/commit/8ed7e59dc08d79751a27c23aadb590f06b43f132","https://access.redhat.com/errata/RHSA-2026:3925","https://access.redhat.com/errata/RHSA-2026:3926","https://access.redhat.com/errata/RHSA-2026:3947","https://access.redhat.com/errata/RHSA-2026:3948","https://access.redhat.com/security/cve/CVE-2026-2603","https://bugzilla.redhat.com/show_bug.cgi?id=2440300","https://github.com/keycloak/keycloak","https://github.com/keycloak/keycloak/commits/26.5.5"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-x4p7-7chp-64hq#Maven/org.keycloak:keycloak-server-spi-private","url":"https://osv.dev/vulnerability/GHSA-x4p7-7chp-64hq"}],"summary":"Keycloak: Unauthorized authentication via disabled SAML Identity Provider"}