{"id":"CVE-2026-93998","kind":"vulnerability","aliases":["CVE-2026-93998"],"related":[],"title":"Keycloak SAML adapter accepts assertions from wrong identity provider","description":"A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.","summary":"The Keycloak SAML adapter does not check that a signed SAML assertion comes from the identity provider configured for the application. If several identity providers share one trusted signing key, an attacker who controls one of them can forge a valid login as any user, possibly including administrators.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["keycloak","runtime","saml","self-hosted"],"not_affected_if":["single-idp-config","unique-signing-keys"],"how_to_check":"Check whether your SAML applications use the Keycloak SAML adapter (org.keycloak:keycloak-saml-adapter-core, or Red Hat build of Keycloak) and trust more than one identity provider with the same signing certificate/key. Single IdP setups, or IdPs with distinct signing keys, are not in the described exposed case. Affected version range: unknown, not yet published.","fix":null,"status":"open","published_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","triaged_at":"2026-11-05T18:40:29+00:00","updated_at":"2026-11-05T18:41:20+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T18:40:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak SAML adapter accepts assertions from wrong identity provider","impact":"high","summary":"The Keycloak SAML adapter does not check that a signed SAML assertion comes from the identity provider configured for the application. If several identity providers share one trusted signing key, an attacker who controls one of them can forge a valid login as any user, possibly including administrators.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","saml","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker logs in as any user, including administrators","analyst_note":"Check the NVD entry and the Keycloak security advisory for affected and fixed versions and the recommended configuration change.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-idp-config","unique-signing-keys"],"who_is_affected":"Applications secured with the Keycloak SAML adapter where more than one identity provider is trusted with the same signing key are the exposed case. Single identity provider setups with unique keys are not described as affected. The sources do not say which Keycloak versions are impacted.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4264,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Keycloak security advisory for affected and fixed versions and the recommended configuration change.","search":"'-2026':11A,14A '-93998':12A,15A 'accept':4A 'adapt':3A,25B,77C,93C 'administr':69B,149C 'applic':42B,86C,113C,142C 'assert':5A,33B,104C,137C 'attack':53B,125C 'authent':91C 'base':90C 'check':28B 'come':34B 'compon':78C 'configur':39B,110C 'control':55B,127C,150C 'creat':133C 'cve':10A,13A 'expect':107C 'fail':94C 'flaw':71C 'forg':60B 'found':73C 'full':148C 'gain':147C 'host':21B 'ident':8A,37B,45B,108C,116C 'includ':68B 'issuer':99C 'key':51B,123C 'keycloak':1A,16B,23B,80C 'log':139C 'login':63B 'match':105C 'multipl':115C 'one':48B,56B,128C 'possibl':67B 'potenti':146C 'provid':9A,38B,46B,109C,117C,131C 'runtim':17B 'saml':2A,18B,24B,32B,76C,89C,103C 'saml-bas':88C 'secur':85C 'self':20B 'self-host':19B 'sever':44B 'share':47B,118C 'sign':31B,50B,102C,122C,136C 'trust':49B,121C 'use':83C 'user':66B,145C 'valid':62B,135C 'verifi':96C 'wrong':7A","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Keycloak SAML adapter and trust more than one identity provider that shares a signing key are exposed: an attacker who controls one of those providers can sign an assertion that the adapter accepts for any user, including admins. Red Hat lists Red Hat build of Keycloak packages (keycloak-core, rhbk keycloak-rhel9 and operator images) without version ranges. Teams with a single identity provider or unique signing keys per provider can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-11-05T18:41:20Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-93998","run_id":1816}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","keycloak","runtime","saml","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93998","severity":null,"published_at":"2026-11-05T18:17:11+00:00","modified_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93998:1816","url":"https://access.redhat.com/security/cve/CVE-2026-93998","severity":null,"published_at":"2026-11-05T18:41:20+00:00","modified_at":"2026-11-05T18:41:20+00:00","first_seen_at":"2026-11-05T18:41:20+00:00","fetched_at":"2026-11-05T18:41:20+00:00","note":"Read Red Hat CVE page (CNA): root cause is the SAML adapter not checking assertion issuer against the configured IdP entity ID; Red Hat rates Important, needs a shared signing key between trusted and untrusted issuers; no mitigation offered. No fixed or affected versions published yet (Red Hat build of Keycloak packages listed without ranges); no upstream Keycloak advisory found; not exploited, no PoC. Fix stays unknown.","cites":["https://access.redhat.com/security/cve/CVE-2026-93998","https://nvd.nist.gov/vuln/detail/CVE-2026-93998"]}],"documents":[{"id":78771,"url":"https://access.redhat.com/security/cve/CVE-2026-93998","title":"Red Hat CVE-2026-93998","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78773,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93998","title":"NVD CVE-2026-93998","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}