{"schemaVersion":3,"id":"CVE-2026-2092","aliases":["CGA-45gv-846r-cfvm","CGA-4m47-jh4r-wx6q","CGA-522w-8jg6-cmm5","CGA-5h3v-79v8-xgcq","CGA-6wr8-fr93-rcmp","CGA-78mp-cg3r-4xmv","CGA-c3q4-r8ww-5j5m","CGA-h2qp-m9fj-r76j","CGA-mgpw-hr63-vc4r","CGA-p685-7jmv-r6xf","CGA-phhq-f4q5-82pf","CGA-r6qr-fj62-rx78","CGA-2232-3g98-4w54","CGA-2gh2-7w9c-gjfh","CGA-2xg7-699g-6p8m","CGA-4775-8c8p-24r7","CGA-47rp-gqjq-493x","CGA-5975-ff3f-gf2g","CGA-5wwh-f6cv-3p73","CGA-635q-356x-88v2","CGA-68qx-qg39-rw5h","CGA-6p73-wxgv-mhqj","CGA-6rw3-h292-rm3j","CGA-7qgh-j4qc-x893","CGA-7wx6-8rrw-mgfw","CGA-8429-2jrw-mj3j","CGA-8gfq-58qj-w98w","CGA-8j7h-8jwp-8hj2","CGA-8mgj-7r5w-v58j","CGA-8rq2-6rp9-mq79","CGA-9j5g-8mh6-r7v5","CGA-c6rj-8vj3-p656","CGA-fvpx-jvww-87cg","CGA-fw9f-r7q9-9g33","CGA-j378-4rff-v5j5","CGA-j999-pmvm-5924","CGA-m96g-9m36-fv36","GHSA-794g-x443-36f7","BIT-keycloak-2026-2092","CGA-qxvh-88ph-7c2r","CGA-rh46-m2g4-7pq7","CGA-v2vh-f277-2gpr","CGA-wr37-wjp9-cf63","CGA-x893-v6ch-f33c","CGA-xgc8-mqmv-9grr","CGA-xh89-vh4p-j9m8"],"status":"published","duplicateOf":null,"title":null,"description":"A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.","dates":{"published":"2026-03-18T01:14:48.364Z","modified":"2026-10-06T16:58:48.805Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.7,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","exploitability":4.6,"impact":8.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","exploitability":4.6,"impact":8.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","exploitability":4.6,"impact":8.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00374,"percentile":0.299,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.067,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00307},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00351,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00374,"percentile":0.299}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00307,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00351,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0036,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00374,"percentile":0.299}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1287","name":"Improper Validation of Specified Type of Input","description":"The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1287.html"}],"affected":[{"vendor":"chainguard","product":"keycloak-26.3-iamguarded-compat","name":"keycloak-26.3-iamguarded-compat","label":"keycloak-26.3-iamguarded-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keycloak-26.3-iamguarded-compat","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keycloak-26.4","name":"keycloak-26.4","label":"keycloak-26.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keycloak-26.4","purlType":"apk","versions":[{"text":"< 26.4.7-r10","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 26.4.7-r10 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keycloak-26.4-iamguarded-compat","name":"keycloak-26.4-iamguarded-compat","label":"keycloak-26.4-iamguarded-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keycloak-26.4-iamguarded-compat","purlType":"apk","versions":[{"text":"< 26.4.7-r10","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 26.4.7-r10 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keycloak-fips-26.3-iamguarded-fips","name":"keycloak-fips-26.3-iamguarded-fips","label":"keycloak-fips-26.3-iamguarded-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keycloak-fips-26.3-iamguarded-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keycloak-fips-26.4","name":"keycloak-fips-26.4","label":"keycloak-fips-26.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keycloak-fips-26.4","purlType":"apk","versions":[{"text":"< 26.4.7-r16","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 26.4.7-r16 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keycloak-fips-26.4-iamguarded-fips","name":"keycloak-fips-26.4-iamguarded-fips","label":"keycloak-fips-26.4-iamguarded-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keycloak-fips-26.4-iamguarded-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 26.4.7-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 26.4.7-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"request-9047-keycloak-fips-26.4","name":"request-9047-keycloak-fips-26.4","label":"request-9047-keycloak-fips-26.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 26.4.7-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 26.4.7-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"request-9047-keycloak-fips-26.4-iamguarded-fips","name":"request-9047-keycloak-fips-26.4-iamguarded-fips","label":"request-9047-keycloak-fips-26.4-iamguarded-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/request-9047-keycloak-fips-26.4-iamguarded-fips","purlType":"apk","versions":[{"text":"< 26.4.7-r19","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 26.4.7-r19 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"keycloak-26.4","name":"keycloak-26.4","label":"keycloak-26.4","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/keycloak-26.4","purlType":"apk","versions":[{"text":"< 26.4.7-r10","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 26.4.7-r10 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"keycloak-26.4-iamguarded-compat","name":"keycloak-26.4-iamguarded-compat","label":"keycloak-26.4-iamguarded-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/keycloak-26.4-iamguarded-compat","purlType":"apk","versions":[{"text":"< 26.4.7-r10","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 26.4.7-r10 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.keycloak","product":"keycloak-services","name":"org.keycloak:keycloak-services","label":"keycloak-services","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.keycloak/keycloak-services","purlType":"maven","versions":[{"text":"≤ 26.2.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.3.0, ≤ 26.4.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.5.0","noFixRecorded":true,"fixedIn":null}],"versionsText":"≤ 26.2.5 | ≥ 26.3.0, ≤ 26.4.7 | ≥ 26.5.0 (No fix recorded)","eol":null,"hubHref":null},{"vendor":"redhat","product":"build_of_keycloak","name":"build of keycloak","label":"build_of_keycloak","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 26.2, < 26.2.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.4, < 26.4.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 26.2, < 26.2.14 | ≥ 26.4, < 26.4.10","eol":null,"hubHref":"/vendor/redhat/build_of_keycloak"}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:3925","label":"access.redhat.com/errata/RHSA-2026:3925","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3926","label":"access.redhat.com/errata/RHSA-2026:3926","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3947","label":"access.redhat.com/errata/RHSA-2026:3947","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3948","label":"access.redhat.com/errata/RHSA-2026:3948","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76128","label":"access.redhat.com/errata/RHSA-2026:76128","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76129","label":"access.redhat.com/errata/RHSA-2026:76129","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76130","label":"access.redhat.com/errata/RHSA-2026:76130","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76132","label":"access.redhat.com/errata/RHSA-2026:76132","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76134","label":"access.redhat.com/errata/RHSA-2026:76134","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2092","label":"access.redhat.com/security/cve/CVE-2026-2092","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","WEB","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437296","label":"bugzilla.redhat.com/show_bug.cgi?id=2437296","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","WEB","Vendor Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2092.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2092.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2092","label":"nvd.nist.gov/vuln/detail/CVE-2026-2092","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/keycloak/keycloak/commit/b40a25908d937bb0563ea516487bc2c7c1d92508","label":"github.com/keycloak/keycloak/commit/b40a25908d937bb0563ea516487bc2c7c1d92508","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/keycloak/keycloak","label":"github.com/keycloak/keycloak","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-794g-x443-36f7","label":"github.com/keycloak/keycloak/security/advisories/GHSA-794g-x443-36f7","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/keycloak/keycloak/pull/46929","label":"github.com/keycloak/keycloak/pull/46929","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":["GHSA-WMXR-6J5F-838P"],"downstream":["RHSA-2026:76128","RHSA-2026:76129","RHSA-2026:76130"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-03-18T01:14:48.364Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-06T16:58:48.805Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:55:18.553Z","stale":false,"partial":false}}