GHSA-wmxr-6j5f-838pHigh· 7.7▾ TwilightDuplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-794g-x443-36f7. This link is maintained to preserve external references.
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
org.keycloak:keycloak-saml-adapter-core < 26.2.14org.keycloak:keycloak-saml-core >= 26.3.0, < 26.4.10org.keycloak:keycloak-services >= 26.5.0, < 26.5.5org.keycloak:keycloak-saml-adapter-core >= 26.3.0, < 26.4.10org.keycloak:keycloak-saml-adapter-core >= 26.5.0, < 26.5.5org.keycloak:keycloak-services < 26.2.14org.keycloak:keycloak-services >= 26.3.0, < 26.4.10org.keycloak:keycloak-saml-core < 26.2.14org.keycloak:keycloak-saml-core >= 26.5.0, < 26.5.5Upgrade to a patched release:
org.keycloak:keycloak-saml-adapter-core 26.2.14org.keycloak:keycloak-saml-core 26.4.10org.keycloak:keycloak-services 26.5.5org.keycloak:keycloak-saml-adapter-core 26.4.10org.keycloak:keycloak-saml-adapter-core 26.5.5org.keycloak:keycloak-services 26.2.14org.keycloak:keycloak-services 26.4.10org.keycloak:keycloak-saml-core 26.2.14org.keycloak:keycloak-saml-core 26.5.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-2092High· 7.7A flaw was found in Keycloak
GHSA-gqj5-2xp5-3qmpHigh· 8.1Duplicate Advisory: Authentication bypass via jwt algorithm confusion
CVE-2026-11800High· 8.1Keycloak has authentication bypass via jwt algorithm confusion
CVE-2025-11537Medium· 5.0Keycloak logs sensitive headers
CVE-2026-9799Medium· 4.6Keycloak allows unauthorized access to resources via uma permission ticket bypass
GHSA-7pm9-g8jh-3m74Medium· 4.9Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing