KEYCLOAK-SERVICES · CVE-2026-92855 · Infrastructure
NO FIX YET
Keycloak's SAML identity broker does not check that the user presenting a holder-of-key assertion holds the matching private key. An attacker who first obtains a valid signed assertion issued for a victim can replay it to log in as that user. Red Hat lists Red Hat build of Keycloak (keycloak-services, rhbk/keycloak-rhel9, rhbk-openshift-rhel9) as affected; upstream Keycloak version ranges are not yet published. Deployments that do not broker SAML logins can skip it.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running Keycloak as an identity broker that delegates login to external SAML identity providers, and that use holder-of-key assertions. Deployments that only use local accounts or non-SAML brokers are not described as affected. The sources do not give version ranges or configuration details.
Not affected if local-accounts-only, no-saml-broker
Who cares keycloak, red-hat-build-of-keycloak, saml, self-hosted
Unknown from the sources.
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.