CVE-2026-2092High· 7.7▾ TwilightA flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML asserti…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
build_of_keycloak >= 26.2, < 26.2.14build_of_keycloak >= 26.4, < 26.4.10Upgrade past the affected range:
build_of_keycloak 26.4.10Affected packages:
org.keycloak:keycloak-services <= 26.2.5org.keycloak:keycloak-services >= 26.3.0, <= 26.4.7org.keycloak:keycloak-services >= 26.5.0, < 26.5.5Source: https://github.com/advisories/GHSA-794g-x443-36f7
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-2575Medium· 5.3A flaw was found in Keycloak
CVE-2026-7307High· 7.5A flaw was found in Keycloak
CVE-2026-7507High· 7.5A session fixation vulnerability was found in Keycloak's login-actions endpoints
CVE-2026-4634High· 7.5A flaw was found in Keycloak
CVE-2026-3009High· 8.1A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator
CVE-2026-2603High· 8.1A flaw was found in Keycloak