Every CVE Search/ Get API key

CVE-2026-2092

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

7.7 HighFix available

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

0.38%Up 0.3 points since Mar 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
CVE-2026-2092
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weakness
CWE-1287, CWE-1287
Updated
2026-11-02
EUVDEUVD-2026-12688 7.7

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
EUVD-2026-12688
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-794g-x443-36f7 7.7

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
GHSA-794g-x443-36f7
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weakness
CWE-1287
Updated
2026-11-02
GitHub AdvisoriesGHSA-wmxr-6j5f-838p 7.7

Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-794g-x443-36f7. This link is maintained to preserve external references.

Original Description

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
GHSA-wmxr-6j5f-838p
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weakness
CWE-1287
Updated
2026-11-02
NVD 7.7

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
CVE-2026-2092
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weakness
CWE-1287
Updated
2026-11-02
OSVGHSA-794g-x443-36f7 7.7

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
GHSA-794g-x443-36f7
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weakness
CWE-1287
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-wmxr-6j5f-838p 7.7

Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-794g-x443-36f7. This link is maintained to preserve external references.

Original Description

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
GHSA-wmxr-6j5f-838p
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weakness
CWE-1287
Updated
2026-11-02
OSVRHSA-2026:76128 9.6

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7

Record
RHSA-2026:76128
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:76129 9.6

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8

Record
RHSA-2026:76129
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:76130 9.6

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9

Record
RHSA-2026:76130
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVBIT-keycloak-2026-2092 No score

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Record
BIT-keycloak-2026-2092
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.keycloak:keycloak-services
Maven
 through 26.2.5 None known
org.keycloak:keycloak-services
Maven
 26.3.0 to 26.4.7 None known
org.keycloak:keycloak-services
Maven
 26.5.0 up to 26.5.5
26.5.5
keycloak
Bitnami
 26.2.0 up to 26.2.14, 26.4.0 up to 26.4.10
26.2.1426.4.10
org.keycloak:keycloak-services
Maven
 through 26.2.5, plus listed versions
1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4
Show 45 moreShow less
1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final
 None known
org.keycloak:keycloak-services
Maven
 26.3.0 to 26.4.7, plus listed versions
26.3.126.3.226.3.326.3.426.3.5
Show 7 moreShow less
26.4.026.4.126.4.226.4.326.4.426.4.526.4.6
 None known
org.keycloak:keycloak-services
Maven
 26.5.0 up to 26.5.5, plus listed versions
26.5.126.5.226.5.326.5.4
26.5.5
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.6::el7
From an advisory covering 27 CVEs
 before 0:18.0.20-1.redhat_00001.1.el7sso
0:18.0.20-1.redhat_00001.1.el7sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.6::el7
From an advisory covering 27 CVEs
 before 0:18.0.20-1.redhat_00001.1.el7sso
0:18.0.20-1.redhat_00001.1.el7sso
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.6::el8
From an advisory covering 27 CVEs
 before 0:18.0.20-1.redhat_00001.1.el8sso
0:18.0.20-1.redhat_00001.1.el8sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.6::el8
From an advisory covering 27 CVEs
 before 0:18.0.20-1.redhat_00001.1.el8sso
0:18.0.20-1.redhat_00001.1.el8sso
rh-sso7-keycloak
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 27 CVEs
 before 0:18.0.20-1.redhat_00001.1.el9sso
0:18.0.20-1.redhat_00001.1.el9sso
rh-sso7-keycloak-server
Red Hat:red_hat_single_sign_on:7.6::el9
From an advisory covering 27 CVEs
 before 0:18.0.20-1.redhat_00001.1.el9sso
0:18.0.20-1.redhat_00001.1.el9sso

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-2092 is a high vulnerability (CVSS 7.7) in Red Hat Build Of Keycloak 26.2, published March 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in org.keycloak:keycloak-services 26.5.5.

References

Show 156 moreShow less
This page doesn't list everything

Left out here: 151 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open