Executive brief
Keycloak, a popular open-source identity and access management solution, contains a vulnerability in how it handles SAML authentication. An attacker with a valid account could bypass security checks to impersonate other users or access sensitive information. This could lead to unauthorized access to corporate applications and potential data breaches.
Technical details
A flaw was identified in Keycloak's SAML broker endpoint where encrypted assertions are not properly validated if the overall SAML response lacks a signature. An attacker possessing a valid signed SAML assertion can craft a malicious SAML response to inject an encrypted assertion for an arbitrary principal. This vulnerability (CWE-1287) requires low privileges and high attack complexity but can result in a scope change, allowing unauthorized access and information disclosure. Patches are available in versions 26.2.14, 26.4.10, and 26.5.5.
Affected products
- Keycloak Keycloak < 26.2.14, >= 26.3.0 < 26.4.10, >= 26.5.0 < 26.5.5
Timeline
- 2026-03-18: disclosed
- 2026-03-18: advisory
- 2026-07-02: other: Advisory withdrawn as a duplicate of GHSA-794g-x443-36f7