Description

Keycloak SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login

A SAML client marked Disabled in the broker realm still completes IdP-initiated broker login and creates a realm SSO session. Even though the target SAML client is disabled, the user gains a valid Keycloak session and can access other enabled clients without re-authentication.
Requirements to exploit

The Keycloak instance must have a disabled SAML client configured as an IdP-initiated broker landing target. The user must also exist in the external IdP.