Live › vulnerability › CVE-2026-2092
Go to dashboardKeycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is unsigned. An attacker holding one valid signed SAML assertion can craft a response with an injected encrypted assertion for another principal, gaining unauthorized access and possibly reading information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:52 UTC, 0h before NVD. All times on this page are UTC.
Deployments that use Keycloak as a SAML identity broker, where the SAML broker endpoint accepts responses whose outer message is not signed. Keycloak installs that only use OIDC or have no SAML identity providers are not exposed. Teams should check the affected version ranges and whether any SAML broker is reachable from the internet.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | <= 26.2.5 | – |
| org.keycloak:keycloak-services | maven | >= 26.3.0, <= 26.4.7 | – |
| org.keycloak:keycloak-services | maven | >= 26.5.0, < 26.5.5 | 26.5.5 |
| redhat build of keycloak | vendor | >= 26.2, < 26.2.14 | 26.2.14 |
| redhat build of keycloak | vendor | >= 26.4, < 26.4.10 | 26.4.10 |
kc.sh --version or the admin console footer and compare it with the affected ranges.26.5.5 on the 26.5 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-2092")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.