Executive brief
Keycloak, an open-source identity and access management solution, contains a vulnerability in how it handles SAML login requests. An attacker with basic user access can bypass security checks to impersonate other users or access sensitive information. This could lead to unauthorized access to corporate applications and potential data breaches.
Technical details
A vulnerability in Keycloak's SAML broker endpoint arises from improper validation of encrypted assertions (CWE-1287) when the encompassing SAML response lacks a digital signature. An attacker possessing a valid signed SAML assertion can craft a malicious SAML response and inject an encrypted assertion for an arbitrary principal. This exploit requires network access and low-level privileges but can result in a scope change, allowing the attacker to gain unauthorized access and disclose sensitive information. The issue affects multiple version ranges including <= 26.2.5, 26.3.x, and 26.5.x. A fix is available in version 26.5.5 and via specific commits in the project repository.
Affected products
- Keycloak Keycloak <= 26.2.5, >= 26.3.0, <= 26.4.7, >= 26.5.0, < 26.5.5
Timeline
- 2026-05-29: disclosed: Initial disclosure to Keycloak maintainers
- 2026-07-02: advisory: GitHub Advisory published