CVE-2026-93998 · Runtime
NO FIX YET
The Keycloak SAML adapter does not check that a signed SAML assertion comes from the identity provider configured for the application. If several identity providers share one trusted signing key, an attacker who controls one of them can forge a valid login as any user, possibly including administrators.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use the Keycloak SAML adapter and trust more than one identity provider that shares a signing key are exposed: an attacker who controls one of those providers can sign an assertion that the adapter accepts for any user, including admins. Red Hat lists Red Hat build of Keycloak packages (keycloak-core, rhbk keycloak-rhel9 and operator images) without version ranges. Teams with a single identity provider or unique signing keys per provider can skip it.
Not affected if single-idp-config, unique-signing-keys
Who cares keycloak, saml, self-hosted
No fix yet, per the sources.
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.