{"id":"CVE-2026-92855","kind":"vulnerability","aliases":["CVE-2026-92855"],"related":[],"title":"Keycloak: SAML broker accepts replayed assertions, letting attackers impersonate users","description":"A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.","summary":"Keycloak's SAML identity broker does not check that the user presenting a holder-of-key assertion holds the matching private key. An attacker who first obtains a valid signed assertion issued for a victim can replay it to log in as that user. Red Hat lists Red Hat build of Keycloak (keycloak-services, rhbk/keycloak-rhel9, rhbk-openshift-rhel9) as affected; upstream Keycloak version ranges are not yet published. Deployments that do not broker SAML logins can skip it.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak-services","fixed":[],"affected":"unknown","ecosystem":"maven"}],"ecosystems":[],"tags":["infrastructure","keycloak","red-hat-build-of-keycloak","saml","self-hosted"],"not_affected_if":["local-accounts-only","no-saml-broker"],"how_to_check":"In the admin console, check Identity Providers for any SAML v2.0 provider; if none, you are not exposed. Check your Keycloak/RHBK version (bin/kc.sh --version) against Keycloak and Red Hat advisories once fixed versions are published. Also check whether your SAML IdP issues holder-of-key subject confirmations.","fix":null,"status":"open","published_at":"2026-11-05T18:17:10+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","triaged_at":"2026-11-05T18:40:31+00:00","updated_at":"2026-11-05T18:42:33+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-05T18:40:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: SAML broker accepts replayed assertions, letting attackers impersonate users","impact":"high","summary":"Keycloak's SAML identity broker does not check that the user presenting a holder-of-key assertion holds the matching private key. An attacker who intercepts a signed assertion can replay it to log in as the victim.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","saml","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as victim by replaying an intercepted assertion","analyst_note":"Sources give no affected or fixed versions and no configuration detail; check the NVD entry and Keycloak security advisories for ranges and the holder-of-key setting.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-saml-broker","local-accounts-only"],"who_is_affected":"Organisations running Keycloak as an identity broker that delegates login to external SAML identity providers, and that use holder-of-key assertions. Deployments that only use local accounts or non-SAML brokers are not described as affected. The sources do not give version ranges or configuration details.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4247,"output_tokens":478,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected or fixed versions and no configuration detail; check the NVD entry and Keycloak security advisories for ranges and the holder-of-key setting.","search":"'-2026':12A,15A '-92855':13A,16A 'accept':4A 'access':173C 'actual':146C 'affect':94B 'assert':6A,49B,63B,158C,166C 'associ':151C 'attack':8A,56B,160C 'authent':129C 'broker':3A,36B,107B,120C,139C 'build':25B,82B 'check':39B 'compon':121C 'cve':11A,14A 'deleg':128C 'deploy':103B 'extern':131C 'fail':140C 'first':58B 'flaw':113C 'found':115C 'gain':171C 'hat':24B,78B,81B 'hold':50B 'holder':46B,155C 'holder-of-key':45B,154C 'host':31B 'ident':35B,119C,132C 'imperson':9A,175C 'infrastructur':20B 'intercept':162C 'issu':64B,135C 'key':48B,54B,150C,157C,182C 'keycloak':1A,18A,21B,27B,32B,84B,86B,96B,123C 'keycloak-servic':85B 'keycloak-services':17A 'let':7A 'list':79B 'log':72B 'login':109B 'match':52B 'need':179C 'obtain':59B 'occur':136C 'openshift':91B 'possess':147C 'present':43B 'privat':53B,149C,181C 'provid':133C 'publish':102B 'rang':98B 'red':23B,77B,80B 'red-hat-build-of-keycloak':22B 'replay':5A,69B,168C 'rhbk':90B 'rhbk-openshift-rhel9':89B 'rhbk/keycloak-rhel9':88B 'rhel9':92B 'saml':2A,28B,34B,108B,118C 'self':30B 'self-host':29B 'servic':87B 'services':19A 'sign':62B,165C 'skip':111B 'unauthor':172C 'upstream':95B 'use':126C 'user':10A,42B,76B,145C 'valid':61B 'verifi':142C 'version':97B 'victim':67B,164C,177C 'without':178C 'yet':101B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Keycloak as an identity broker that delegates login to external SAML identity providers, and that use holder-of-key assertions. Deployments that only use local accounts or non-SAML brokers are not described as affected. The sources do not give version ranges or configuration details.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["keycloakservices"],"ptokens":["keycloak","services"],"labels":["high","infrastructure","keycloak","redhatbuildofkeycloak","saml","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92855","severity":null,"published_at":"2026-11-05T18:17:10+00:00","modified_at":"2026-11-05T18:17:10+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92855:1818","url":"https://access.redhat.com/security/cve/CVE-2026-92855","severity":null,"published_at":"2026-11-05T18:42:33+00:00","modified_at":"2026-11-05T18:42:33+00:00","first_seen_at":"2026-11-05T18:42:33+00:00","fetched_at":"2026-11-05T18:42:33+00:00","note":"Red Hat CVE page read (only primary source found). No affected/fixed versions published yet; upstream Keycloak GHSA/issue not found. Red Hat: Important, 7.4, no mitigation, reporter yd1ng. No exploitation reported.","cites":["https://access.redhat.com/security/cve/CVE-2026-92855"]}],"documents":[{"id":78882,"url":"https://access.redhat.com/security/cve/CVE-2026-92855","title":"Red Hat CVE-2026-92855","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}