CVE-2026-2092 HIGH

CVE-2026-2092: Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

Vendor Red Hat
Product Red Hat build of Keycloak 26.2.14
Weakness CWE-1287
Published March 18, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

What the vulnerability does

01Description

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Key dates

02Disclosure timeline

March 18, 2026 CVE published
June 30, 2026 Record updated