Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
The advisory, in context
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 26.2.5 (inclusive)
No fix recorded for this interval.
202 explicitly affected versions
1.0-alpha-1, 1.0-alpha-1-12062013, 1.0-alpha-2, 1.0-alpha-3, 1.0-alpha-4, 1.0-beta-1, 1.0-beta-1-20150521, 1.0-beta-1-20150523, 1.0-beta-2, 1.0-beta-3, 1.0-beta-4, 1.0-final, 1.0-rc-1, 1.0-rc-2, 1.0.1.Final, 1.0.2.Final, 1.0.3.Final, 1.0.4.Final, 1.0.5.Final, 1.1.0.Beta1, 1.1.0.Beta2, 1.1.0.Final, 1.1.1.Final, 1.2.0.Beta1, 1.2.0.CR1, 1.2.0.Final, 1.3.0.Final, 1.3.1.Final, 1.4.0.Final, 1.5.0-Final, 1.5.0.Final, 1.5.1.Final, 1.6.0.Final, 1.6.1.Final, 1.7.0.CR1, 1.7.0.Final, 1.8.0.Alpha1, 1.8.0.CR1, 1.8.0.CR2, 1.8.0.CR3, 1.8.0.Final, 1.8.1.Final, 1.9.0.CR1, 1.9.0.Final, 1.9.1.Final, 1.9.2.Final, 1.9.3.Final, 1.9.4.Final, 1.9.5.Final, 1.9.7.Final, 1.9.8.Final, 10.0.0, 10.0.1, 10.0.2, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 13.0.0, 13.0.1, 14.0.0, 15.0.0, 15.0.1, 15.0.2, 15.1.0, 15.1.1, 16.0.0, 16.1.0, 16.1.1, 17.0.0, 17.0.1, 18.0.0, 18.0.1, 18.0.2, 19.0.0, 19.0.1, 19.0.2, 19.0.3, 2.0.0.CR1, 2.0.0.Final, 2.1.0.CR1, 2.1.0.Final, 2.2.0.CR1, 2.2.0.Final, 2.2.1.Final, 2.3.0.CR1, 2.3.0.Final, 2.4.0.CR1, 2.4.0.Final, 2.5.0.CR1, 2.5.0.Final, 2.5.1.Final, 2.5.4.Final, 2.5.5.Final, 20.0.0, 20.0.1, 20.0.2, 20.0.3, 20.0.4, 20.0.5, 21.0.0, 21.0.1, 21.0.2, 21.1.0, 21.1.1, 21.1.2, 22.0.0, 22.0.1, 22.0.2, 22.0.3, 22.0.4, 22.0.5, 23.0.0, 23.0.1, 23.0.2, 23.0.3, 23.0.4, 23.0.5, 23.0.6, 23.0.7, 24.0.0, 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 25.0.0, 25.0.1, 25.0.2, 25.0.3, 25.0.4, 25.0.5, 25.0.6, 26.0.0, 26.0.1, 26.0.2, 26.0.3, 26.0.4, 26.0.5, 26.0.6, 26.0.7, 26.0.8, 26.1.0, 26.1.1, 26.1.2, 26.1.3, 26.1.4, 26.1.5, 26.2.0, 26.2.1, 26.2.2, 26.2.3, 26.2.4, 26.2.5, 3.0.0.CR1, 3.0.0.Final, 3.1.0.CR1, 3.1.0.Final, 3.2.0.CR1, 3.2.0.Final, 3.2.1.Final, 3.3.0.CR1, 3.3.0.CR2, 3.3.0.Final, 3.4.0.CR1, 3.4.0.Final, 3.4.1.CR1, 3.4.1.Final, 3.4.2.Final, 3.4.3.Final, 4.0.0.Beta1, 4.0.0.Beta2, 4.0.0.Beta3, 4.0.0.Final, 4.1.0.Final, 4.2.0.Final, 4.2.1.Final, 4.3.0.Final, 4.4.0.Final, 4.5.0.Final, 4.6.0.Final, 4.7.0.Final, 4.8.0.Final, 4.8.1.Final, 4.8.2.Final, 4.8.3.Final, 5.0.0, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 8.0.2, 9.0.0, 9.0.2, 9.0.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.2.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0-alpha-1",
"1.0-alpha-1-12062013",
"1.0-alpha-2",
"1.0-alpha-3",
"1.0-alpha-4",
"1.0-beta-1",
"1.0-beta-1-20150521",
"1.0-beta-1-20150523",
"1.0-beta-2",
"1.0-beta-3",
"1.0-beta-4",
"1.0-final",
"1.0-rc-1",
"1.0-rc-2",
"1.0.1.Final",
"1.0.2.Final",
"1.0.3.Final",
"1.0.4.Final",
"1.0.5.Final",
"1.1.0.Beta1",
"1.1.0.Beta2",
"1.1.0.Final",
"1.1.1.Final",
"1.2.0.Beta1",
"1.2.0.CR1",
"1.2.0.Final",
"1.3.0.Final",
"1.3.1.Final",
"1.4.0.Final",
"1.5.0-Final",
"1.5.0.Final",
"1.5.1.Final",
"1.6.0.Final",
"1.6.1.Final",
"1.7.0.CR1",
"1.7.0.Final",
"1.8.0.Alpha1",
"1.8.0.CR1",
"1.8.0.CR2",
"1.8.0.CR3",
"1.8.0.Final",
"1.8.1.Final",
"1.9.0.CR1",
"1.9.0.Final",
"1.9.1.Final",
"1.9.2.Final",
"1.9.3.Final",
"1.9.4.Final",
"1.9.5.Final",
"1.9.7.Final",
"1.9.8.Final",
"10.0.0",
"10.0.1",
"10.0.2",
"11.0.0",
"11.0.1",
"11.0.2",
"11.0.3",
"12.0.0",
"12.0.1",
"12.0.2",
"12.0.3",
"12.0.4",
"13.0.0",
"13.0.1",
"14.0.0",
"15.0.0",
"15.0.1",
"15.0.2",
"15.1.0",
"15.1.1",
"16.0.0",
"16.1.0",
"16.1.1",
"17.0.0",
"17.0.1",
"18.0.0",
"18.0.1",
"18.0.2",
"19.0.0",
"19.0.1",
"19.0.2",
"19.0.3",
"2.0.0.CR1",
"2.0.0.Final",
"2.1.0.CR1",
"2.1.0.Final",
"2.2.0.CR1",
"2.2.0.Final",
"2.2.1.Final",
"2.3.0.CR1",
"2.3.0.Final",
"2.4.0.CR1",
"2.4.0.Final",
"2.5.0.CR1",
"2.5.0.Final",
"2.5.1.Final",
"2.5.4.Final",
"2.5.5.Final",
"20.0.0",
"20.0.1",
"20.0.2",
"20.0.3",
"20.0.4",
"20.0.5",
"21.0.0",
"21.0.1",
"21.0.2",
"21.1.0",
"21.1.1",
"21.1.2",
"22.0.0",
"22.0.1",
"22.0.2",
"22.0.3",
"22.0.4",
"22.0.5",
"23.0.0",
"23.0.1",
"23.0.2",
"23.0.3",
"23.0.4",
"23.0.5",
"23.0.6",
"23.0.7",
"24.0.0",
"24.0.1",
"24.0.2",
"24.0.3",
"24.0.4",
"24.0.5",
"25.0.0",
"25.0.1",
"25.0.2",
"25.0.3",
"25.0.4",
"25.0.5",
"25.0.6",
"26.0.0",
"26.0.1",
"26.0.2",
"26.0.3",
"26.0.4",
"26.0.5",
"26.0.6",
"26.0.7",
"26.0.8",
"26.1.0",
"26.1.1",
"26.1.2",
"26.1.3",
"26.1.4",
"26.1.5",
"26.2.0",
"26.2.1",
"26.2.2",
"26.2.3",
"26.2.4",
"26.2.5",
"3.0.0.CR1",
"3.0.0.Final",
"3.1.0.CR1",
"3.1.0.Final",
"3.2.0.CR1",
"3.2.0.Final",
"3.2.1.Final",
"3.3.0.CR1",
"3.3.0.CR2",
"3.3.0.Final",
"3.4.0.CR1",
"3.4.0.Final",
"3.4.1.CR1",
"3.4.1.Final",
"3.4.2.Final",
"3.4.3.Final",
"4.0.0.Beta1",
"4.0.0.Beta2",
"4.0.0.Beta3",
"4.0.0.Final",
"4.1.0.Final",
"4.2.0.Final",
"4.2.1.Final",
"4.3.0.Final",
"4.4.0.Final",
"4.5.0.Final",
"4.6.0.Final",
"4.7.0.Final",
"4.8.0.Final",
"4.8.1.Final",
"4.8.2.Final",
"4.8.3.Final",
"5.0.0",
"6.0.0",
"6.0.1",
"7.0.0",
"7.0.1",
"8.0.0",
"8.0.1",
"8.0.2",
"9.0.0",
"9.0.2",
"9.0.3"
]
}From 26.3.0 through 26.4.7 (inclusive)
No fix recorded for this interval.
14 explicitly affected versions
26.3.0, 26.3.1, 26.3.2, 26.3.3, 26.3.4, 26.3.5, 26.4.0, 26.4.1, 26.4.2, 26.4.3, 26.4.4, 26.4.5, 26.4.6, 26.4.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "26.3.0"
},
{
"last_affected": "26.4.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"26.3.0",
"26.3.1",
"26.3.2",
"26.3.3",
"26.3.4",
"26.3.5",
"26.4.0",
"26.4.1",
"26.4.2",
"26.4.3",
"26.4.4",
"26.4.5",
"26.4.6",
"26.4.7"
]
}From 26.5.0 before 26.5.5
Fixed in 26.5.5
5 explicitly affected versions
26.5.0, 26.5.1, 26.5.2, 26.5.3, 26.5.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "26.5.0"
},
{
"fixed": "26.5.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"26.5.0",
"26.5.1",
"26.5.2",
"26.5.3",
"26.5.4"
]
}References
- https://github.com/keycloak/keycloak/security/advisories/GHSA-794g-x443-36f7
- https://nvd.nist.gov/vuln/detail/CVE-2026-2092
- https://github.com/keycloak/keycloak/pull/46929
- https://github.com/keycloak/keycloak/commit/b40a25908d937bb0563ea516487bc2c7c1d92508
- https://access.redhat.com/errata/RHSA-2026:3925
- https://access.redhat.com/errata/RHSA-2026:3926
- https://access.redhat.com/errata/RHSA-2026:3947
- https://access.redhat.com/errata/RHSA-2026:3948
- https://access.redhat.com/security/cve/CVE-2026-2092
- https://bugzilla.redhat.com/show_bug.cgi?id=2437296
- https://github.com/keycloak/keycloak
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2092.json