---
id: "CVE-2026-92855"
kind: "vulnerability"
aliases: ["CVE-2026-92855"]
title: "Keycloak: SAML broker accepts replayed assertions, letting attackers impersonate users"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "keycloak-services", "fixed": [], "affected": "unknown", "ecosystem": "maven"}]
ecosystems: []
tags: ["infrastructure", "keycloak", "red-hat-build-of-keycloak", "saml", "self-hosted"]
not_affected_if: ["local-accounts-only", "no-saml-broker"]
published_at: "2026-11-05T18:17:10+00:00"
first_seen_at: "2026-11-05T18:40:10+00:00"
updated_at: "2026-11-05T18:42:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92855", "first_seen_at": "2026-11-05T18:40:10+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-92855", "first_seen_at": "2026-11-05T18:42:33+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-92855"]}]
exploit_sources: []
---

# Keycloak: SAML broker accepts replayed assertions, letting attackers impersonate users

Keycloak's SAML identity broker does not check that the user presenting a holder-of-key assertion holds the matching private key. An attacker who first obtains a valid signed assertion issued for a victim can replay it to log in as that user. Red Hat lists Red Hat build of Keycloak (keycloak-services, rhbk/keycloak-rhel9, rhbk-openshift-rhel9) as affected; upstream Keycloak version ranges are not yet published. Deployments that do not broker SAML logins can skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:keycloak-services affected unknown fixed no fixed version listed

## How to check

In the admin console, check Identity Providers for any SAML v2.0 provider; if none, you are not exposed. Check your Keycloak/RHBK version (bin/kc.sh --version) against Keycloak and Red Hat advisories once fixed versions are published. Also check whether your SAML IdP issues holder-of-key subject confirmations.

## Timeline

- 2026-11-05T18:40:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92855
- 2026-11-05T18:42:33+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-92855 — Red Hat CVE page read (only primary source found). No affected/fixed versions published yet; upstream Keycloak GHSA/issue not found. Red Hat: Important, 7.4, no mitigation, reporter yd1ng. No exploitation reported.

## Documents

- [advisory] Red Hat CVE-2026-92855 https://access.redhat.com/security/cve/CVE-2026-92855

## From the sources

A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_