CVE-2026-2092

EUVD-2026-12688

18.03.2026, 02:16

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.7 HIGH	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 23.27%

Affected Products (NVD)

Vendor	Product	Version
redhat	build_of_keycloak	26.2 ≤ 𝑥 < 26.2.14
redhat	build_of_keycloak	26.4 ≤ 𝑥 < 26.4.10

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat build of Keycloak 26.2	26.2.14-1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat build of Keycloak 26.2	26.2-16 ≤ 𝑥 < *	ADP
Red Hat	Red Hat build of Keycloak 26.2	26.2-16 ≤ 𝑥 < *	ADP
Red Hat	Red Hat build of Keycloak 26.4	26.4.10-1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat build of Keycloak 26.4	26.4-12 ≤ 𝑥 < *	ADP
Red Hat	Red Hat build of Keycloak 26.4	26.4-12 ≤ 𝑥 < *	ADP

Common Weakness Enumeration

CWE-1287 - Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References

https://access.redhat.com/errata/RHSA-2026:3925

https://access.redhat.com/errata/RHSA-2026:3926

https://access.redhat.com/errata/RHSA-2026:3947

https://access.redhat.com/errata/RHSA-2026:3948

https://access.redhat.com/security/cve/CVE-2026-2092