CVE-2026-92855
Description
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
Statement
The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that exploitation requires the attacker to obtain a valid signed SAML assertion issued for a victim. Successful exploitation allows an attacker to bypass authentication and impersonate users within the Keycloak environment. The vulnerability's root cause is the failure of the SAML broker to enforce proof of key possession when processing holder-of-key assertions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce proof of possession for bound keys in SAML identity broker subject-confirmation validation: upgrade to Keycloak 26.4.17 / 26.6.8 (or the corresponding fixed Red Hat builds), which enforce proof of possession for the bound key or reject assertions that contain only unvalidated holder-of-key confirmations, closing replaying intercepted SAML holder-of-key assertions. Until patched, this is a concern on Keycloak deployments configured as a SAML identity broker trusting upstream providers that issue holder-of-key assertions, so restrict and audit trusted upstream SAML identity providers issuing holder-of-key assertions to prevent interception and unauthorized replay of signed assertions. As a compensating measure, enforce mandatory secondary authentication factor in Keycloak post-federation to block login completion on replayed assertions. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing proof-of-possession verification flaw — apply the upstream patch to fully remediate.
Highest-impact CME: CME-801 Multi-Factor Authentication (MFA) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 7.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Read Application Data; Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
Acknowledgements
Red Hat would like to thank yd1ng for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
