Red Hat build of Keycloak 26.4 · Vulnerability
Historical advisory recorded 6 Nov 2026 12:03:43 UTC. Read the latest advisory.
cve-program · CVE-2026-92855
PublishedA flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-92855
PublishedKeycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
- Source published
- 5 Nov 2026 17:15:07 UTC
- Source modified
- 6 Nov 2026 10:23:13 UTC
- Saved here
- 6 Nov 2026 12:03:43 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N