CVE-2026-2092: Keycloak SAML Adapter Core - Unauthorized Access via Improper Validation of Encrypted Assertions
Summary
CVE-2026-2092: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions. Affects org.keycloak:keycloak-saml-adapter-core versions < 26.5.5. No fix is published. How to fix ↓
Also tracked for
- keycloak · Bitnami
- org.keycloak:keycloak-services · Maven
The same CVE-2026-2092 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that enables secure authentication and authorization for applications. It supports various protocols, including SAML, which allows for single sign-on (SSO) capabilities. The Keycloak SAML adapter core is responsible for handling SAML assertions and responses, ensuring that users can authenticate securely across different services. However, a vulnerability has been identified that compromises the security of this component, potentially allowing unauthorized access to sensitive information.
Vulnerability Detail
A flaw exists in Keycloak's handling of Security Assertion Markup Language (SAML) responses, specifically in the broker endpoint's validation of encrypted assertions. When the overall SAML response is not signed, the system fails to properly validate the encrypted assertions. An attacker with a valid signed SAML assertion can exploit this vulnerability by crafting a malicious SAML response that injects an encrypted assertion for an arbitrary principal. This can lead to unauthorized access to user accounts and potential information disclosure, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that all SAML responses are signed before processing them. This can help mitigate the risk of unauthorized access until a proper patch is applied. Additionally, consider implementing strict validation checks for SAML assertions to prevent the injection of malicious assertions.
Conclusion
The vulnerability identified as CVE-2026-2092 in Keycloak poses a significant risk due to improper validation of encrypted SAML assertions. It is crucial for users to update their Keycloak packages to the patched version 26.5.6 to mitigate this risk. Implementing workarounds and utilizing tools like Vulert can further enhance security measures.
See every vulnerability recorded for org.keycloak:keycloak-saml-adapter-core →
FAQ
CVE-2026-2092 is a vulnerability in Keycloak that allows unauthorized access due to improper validation of encrypted SAML assertions.
The affected packages include keycloak-saml-adapter-core, keycloak-saml-core, and keycloak-services, all versions up to 26.5.5.
Exploitation of this vulnerability can lead to unauthorized access to user accounts and potential information disclosure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 7.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-saml-adapter-core.
