7.7High
CVE-2026-2092Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions
Description
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
Weakness (CWE):
CWE-1287
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| build keycloak | 26.2 | — | |
| build keycloak | 26.4 | — | |
| redhat | build of keycloak | 26.2 – < 26.2.14 | |
| Red Hat | Red Hat build of Keycloak 26.2 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.2.14 | — | |
| Red Hat | Red Hat build of Keycloak 26.4 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.4.10 | — | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | |
| Red Hat | RHEL-8 based Middleware Containers | all versions | |
| red hat single sign on | 7.6 | — | |
| rhosemc | 1.0 | — |
References and patches
- RHSA-2026:3925 vendor-advisoryVendor Advisory
- RHSA-2026:3926 vendor-advisoryVendor Advisory
- RHSA-2026:3947 vendor-advisoryVendor Advisory
- RHSA-2026:3948 vendor-advisoryVendor Advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-2092 vdb-entryVendor Advisory
- RHBZ#2437296 issue-trackingIssue TrackingVendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2092.json Vendor Advisory
CPE matches (NVD) (2)
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*≥ 26.2 < 26.2.14cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*≥ 26.4 < 26.4.10