Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

ÉLEVÉE 7.7CVE-2026-2092 · BIT-keycloak-2026-2092 · GHSA-794g-x443-36f7 · Published 18/03/2026 · updated 06/10/2026

En bref

CVE-2026-2092 est une vulnérabilité ÉLEVÉE (CVSS 7.7) touchant org.keycloak:keycloak-services, build of keycloak (redhat).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.38%, plus élevée que 31.4% des vulnérabilités.
Correctif : mettre à jour vers 26.5.5, 26.2.14, 26.4.10 ou plus récent.

Package	Affected versions	Patched versions
org.keycloak:keycloak-services Maven	`≥ 26.3.0, ≤ 26.4.7≥ 26.5.0, < 26.5.5≤ 26.2.5`	`26.5.5`
build of keycloak redhat	`≥ 26.2, < 26.2.14≥ 26.4, < 26.4.10`	`26.2.1426.4.10`

Description

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

NVD description

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.