This advisory covers security fixes in Red Hat build of Keycloak 26.2.14 images used on OpenShift Container Platform. The vulnerabilities addressed include CVE-2026-3047, an authentication bypass caused by a disabled SAML client completing IdP-initiated login; CVE-2026-2603, unauthorized authentication via a disabled SAML Identity Provider; and CVE-2026-2092, unauthorized access resulting from improper validation of encrypted SAML assertions. These issues affect the SAML broker and identity provider components of Keycloak, potentially allowing unauthorized authentication and access. The advisory provides updated container images to remediate these issues.

Successful exploitation of these vulnerabilities could allow attackers to bypass authentication controls or gain unauthorized access to systems relying on Keycloak for SAML-based single sign-on. This undermines the security of user authentication and could lead to unauthorized access to protected applications and services managed by Keycloak within OpenShift environments.

Red Hat has released updated Keycloak 26.2.14 container images that address these vulnerabilities. Users should back up their existing installations and apply the updated images as provided by Red Hat to remediate the issues. Since this is a containerized product, deploying the updated images replaces vulnerable components. No additional mitigations are specified in the advisory.