---
id: "CVE-2026-93998"
kind: "vulnerability"
aliases: ["CVE-2026-93998"]
title: "Keycloak SAML adapter accepts assertions from wrong identity provider"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["keycloak", "runtime", "saml", "self-hosted"]
not_affected_if: ["single-idp-config", "unique-signing-keys"]
published_at: "2026-11-05T18:17:11+00:00"
first_seen_at: "2026-11-05T18:40:10+00:00"
updated_at: "2026-11-05T18:41:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93998", "first_seen_at": "2026-11-05T18:40:10+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-93998", "first_seen_at": "2026-11-05T18:41:20+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-93998", "https://nvd.nist.gov/vuln/detail/CVE-2026-93998"]}]
exploit_sources: []
---

# Keycloak SAML adapter accepts assertions from wrong identity provider

The Keycloak SAML adapter does not check that a signed SAML assertion comes from the identity provider configured for the application. If several identity providers share one trusted signing key, an attacker who controls one of them can forge a valid login as any user, possibly including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether your SAML applications use the Keycloak SAML adapter (org.keycloak:keycloak-saml-adapter-core, or Red Hat build of Keycloak) and trust more than one identity provider with the same signing certificate/key. Single IdP setups, or IdPs with distinct signing keys, are not in the described exposed case. Affected version range: unknown, not yet published.

## Timeline

- 2026-11-05T18:40:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93998
- 2026-11-05T18:41:20+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-93998 — Read Red Hat CVE page (CNA): root cause is the SAML adapter not checking assertion issuer against the configured IdP entity ID; Red Hat rates Important, needs a shared signing key between trusted and untrusted issuers; no mitigation offered. No fixed or affected versions published yet (Red Hat build of Keycloak packages listed without ranges); no upstream Keycloak advisory found; not exploited, no PoC. Fix stays unknown.

## Documents

- [advisory] Red Hat CVE-2026-93998 https://access.redhat.com/security/cve/CVE-2026-93998
- [mentions] NVD CVE-2026-93998 https://nvd.nist.gov/vuln/detail/CVE-2026-93998

## From the sources

A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_