All vulnerabilities
CVE-2026-2092BIT-keycloak-2026-2092GHSA-794g-x443-36f7

org.keycloak:keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Red Hat org.keycloak:keycloak-servicesmavenIdentity & access
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed in26.5.5Fixed versionGitHub
Published18 Mar 2026Updated 26 Oct 2026CVE List

What fixes it

  • 26.5.5org.keycloak:keycloak-services, mavenGitHub<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-services</artifactId><version>26.5.5</version></dependency>
  • 26.5.5org.keycloak:keycloak-services, MavenOSV<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-services</artifactId><version>26.5.5</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Text from CVE List

Affected versions 83

  • org.keycloak:keycloak-services, maven<= 26.2.5GitHub
  • org.keycloak:keycloak-services, maven>= 26.3.0, <= 26.4.7GitHub
  • org.keycloak:keycloak-services, maven>= 26.5.0, < 26.5.5GitHub
  • Red Hat build of Keycloak 26.2unaffected: 26.2.14-1 and laterCVE List
  • Red Hat build of Keycloak 26.2unaffected: 26.2-16 and laterCVE List
  • Red Hat build of Keycloak 26.4unaffected: 26.4.10-1 and laterCVE List
  • Red Hat build of Keycloak 26.4unaffected: 26.4-12 and laterCVE List
  • Red Hat Single Sign-On 7.6 for RHEL 7unaffected: 0:18.0.20-1.redhat_00001.1.el7sso and laterCVE List
  • Red Hat Single Sign-On 7.6 for RHEL 8unaffected: 0:18.0.20-1.redhat_00001.1.el8sso and laterCVE List
  • Red Hat Single Sign-On 7.6 for RHEL 9unaffected: 0:18.0.20-1.redhat_00001.1.el9sso and laterCVE List
  • RHEL-8 based Middleware Containersunaffected: 7.6-85 and laterCVE List
  • org.keycloak:keycloak-services, Mavenfrom first release, through 26.2.5OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-1OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-1-12062013OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-2OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-3OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-4OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1-20150521OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1-20150523OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-2OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-3OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-4OSV
  • org.keycloak:keycloak-services, Maven1.0-finalOSV
  • org.keycloak:keycloak-services, Maven1.0-rc-1OSV
  • org.keycloak:keycloak-services, Maven1.0-rc-2OSV
  • org.keycloak:keycloak-services, Maven1.0.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.2.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.3.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.4.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.5.FinalOSV
  • org.keycloak:keycloak-services, Maven1.1.0.Beta1OSV
  • org.keycloak:keycloak-services, Maven1.1.0.Beta2OSV
  • org.keycloak:keycloak-services, Maven1.1.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.1.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.2.0.Beta1OSV
  • org.keycloak:keycloak-services, Maven1.2.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.2.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.3.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.3.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.4.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.0-FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.6.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.6.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.7.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.7.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.8.0.Alpha1OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR2OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR3OSV
  • org.keycloak:keycloak-services, Maven1.8.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.8.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.9.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.2.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.3.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.4.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.5.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.7.FinalOSV
  • org.keycloak:keycloak-services, Mavenfrom 26.3.0, through 26.4.7OSV
  • org.keycloak:keycloak-services, Maven26.3.0OSV
  • org.keycloak:keycloak-services, Maven26.3.1OSV
  • org.keycloak:keycloak-services, Maven26.3.2OSV
  • org.keycloak:keycloak-services, Maven26.3.3OSV
  • org.keycloak:keycloak-services, Maven26.3.4OSV
  • org.keycloak:keycloak-services, Maven26.3.5OSV
  • org.keycloak:keycloak-services, Maven26.4.0OSV
  • org.keycloak:keycloak-services, Maven26.4.1OSV
  • org.keycloak:keycloak-services, Maven26.4.2OSV
  • org.keycloak:keycloak-services, Maven26.4.3OSV
  • org.keycloak:keycloak-services, Maven26.4.4OSV
  • org.keycloak:keycloak-services, Maven26.4.5OSV
  • org.keycloak:keycloak-services, Maven26.4.6OSV
  • org.keycloak:keycloak-services, Maven26.4.7OSV
  • org.keycloak:keycloak-services, Mavenfrom 26.5.0, fixed in 26.5.5OSV
  • org.keycloak:keycloak-services, Maven26.5.0OSV
  • org.keycloak:keycloak-services, Maven26.5.1OSV
  • org.keycloak:keycloak-services, Maven26.5.2OSV
  • org.keycloak:keycloak-services, Maven26.5.3OSV
  • org.keycloak:keycloak-services, Maven26.5.4OSV

References 17