{"id":"CVE-2026-2092","title":"Keycloak: Unauthorized access via improper validation of encrypted SAML assertions","summary":"Keycloak: Unauthorized access via improper validation of encrypted SAML assertions","severity":"high","cvss":7.7,"cwe":["CWE-1287"],"vendor":"keycloak","product":"org.keycloak:keycloak-services","ecosystem":"maven","affected":["org.keycloak:keycloak-services <= 26.2.5","org.keycloak:keycloak-services >= 26.3.0, <= 26.4.7","org.keycloak:keycloak-services >= 26.5.0, < 26.5.5"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-794g-x443-36f7","references":[{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-794g-x443-36f7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2092"},{"url":"https://github.com/keycloak/keycloak/pull/46929"},{"url":"https://github.com/keycloak/keycloak/commit/b40a25908d937bb0563ea516487bc2c7c1d92508"},{"url":"https://access.redhat.com/errata/RHSA-2026:3925"},{"url":"https://access.redhat.com/errata/RHSA-2026:3926"},{"url":"https://access.redhat.com/errata/RHSA-2026:3947"},{"url":"https://access.redhat.com/errata/RHSA-2026:3948"},{"url":"https://access.redhat.com/security/cve/CVE-2026-2092"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437296"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2092.json"},{"url":"https://github.com/advisories/GHSA-794g-x443-36f7"}],"tags":["ghsa","maven"],"epss":0.00307,"epssPercentile":0.23591,"ingestedAt":"2026-07-02T21:44:45.105Z","slug":"CVE-2026-2092","body":"## Overview\n\nKeycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.\n\n## Affected packages\n\n- `org.keycloak:keycloak-services <= 26.2.5`\n- `org.keycloak:keycloak-services >= 26.3.0, <= 26.4.7`\n- `org.keycloak:keycloak-services >= 26.5.0, < 26.5.5`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}