CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-2092

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 22.8%

CVSS Severity

CVSS v3 Score 7.7

References

Products affected by CVE-2026-2092

Redhat » Build Of Keycloak » Version: 26.2

cpe:2.3:a:redhat:build_of_keycloak:26.2
Redhat » Build Of Keycloak » Version: 26.2.10

cpe:2.3:a:redhat:build_of_keycloak:26.2.10
Redhat » Build Of Keycloak » Version: 26.2.11

cpe:2.3:a:redhat:build_of_keycloak:26.2.11
Redhat » Build Of Keycloak » Version: 26.2.12

cpe:2.3:a:redhat:build_of_keycloak:26.2.12
Redhat » Build Of Keycloak » Version: 26.2.13

cpe:2.3:a:redhat:build_of_keycloak:26.2.13
Redhat » Build Of Keycloak » Version: 26.2.5

cpe:2.3:a:redhat:build_of_keycloak:26.2.5
Redhat » Build Of Keycloak » Version: 26.2.6

cpe:2.3:a:redhat:build_of_keycloak:26.2.6
Redhat » Build Of Keycloak » Version: 26.2.7

cpe:2.3:a:redhat:build_of_keycloak:26.2.7
Redhat » Build Of Keycloak » Version: 26.2.8

cpe:2.3:a:redhat:build_of_keycloak:26.2.8
Redhat » Build Of Keycloak » Version: 26.2.9

cpe:2.3:a:redhat:build_of_keycloak:26.2.9
Redhat » Build Of Keycloak » Version: 26.4

cpe:2.3:a:redhat:build_of_keycloak:26.4
Redhat » Build Of Keycloak » Version: 26.4.4

cpe:2.3:a:redhat:build_of_keycloak:26.4.4
Redhat » Build Of Keycloak » Version: 26.4.5

cpe:2.3:a:redhat:build_of_keycloak:26.4.5
Redhat » Build Of Keycloak » Version: 26.4.6

cpe:2.3:a:redhat:build_of_keycloak:26.4.6
Redhat » Build Of Keycloak » Version: 26.4.7

cpe:2.3:a:redhat:build_of_keycloak:26.4.7
Redhat » Build Of Keycloak » Version: 26.4.8

cpe:2.3:a:redhat:build_of_keycloak:26.4.8
Redhat » Build Of Keycloak » Version: 26.4.9

cpe:2.3:a:redhat:build_of_keycloak:26.4.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-2092

Products

Pricing

Contact Us