CVE-2026-2092: 
Java vulnerability analysis and mitigation

CVE-2026-2092 is an improper validation of encrypted SAML assertions vulnerability in Keycloak's SAML broker endpoint. The flaw allows an attacker with a valid signed SAML assertion to craft a malicious SAML response and inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure. It was disclosed on March 5, 2026, and affects Red Hat build of Keycloak versions 26.2.x (prior to 26.2.14) and 26.4.x (prior to 26.4.10). The vulnerability carries a CVSS v3.1 base score of 7.7 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-1287 (Improper Validation of Specified Type of Input). Keycloak's SAML broker endpoint fails to properly validate encrypted assertions when the overall SAML response is unsigned — it validates the inner assertion's signature but does not enforce that the enclosing SAML response itself is signed. An attacker who possesses a legitimately signed SAML assertion can strip it from its original response, wrap it in a crafted unsigned SAML response, and inject an encrypted assertion for a different (arbitrary) principal. Exploitation requires the attacker to hold low-level authenticated privileges and operate over the network, with high attack complexity (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation allows an attacker to impersonate arbitrary principals within Keycloak-federated applications, resulting in unauthorized access to protected resources and potential exposure of sensitive user data (high confidentiality impact). The vulnerability has a changed scope, meaning it can affect resources and services beyond the Keycloak instance itself — including downstream applications relying on SAML-based single sign-on. Integrity and availability impacts are assessed as low, with limited potential for data modification or service disruption (Red Hat CVE, RHSA-2026:3926).

1. Obtain a valid signed SAML assertion: The attacker authenticates to a legitimate Identity Provider (IdP) federated with the target Keycloak instance and obtains a signed SAML assertion for their own account.
2. Craft a malicious SAML response: The attacker constructs a new SAML response that is unsigned (no signature on the <samlp:Response> element) but contains an encrypted <saml:EncryptedAssertion> element targeting an arbitrary principal (e.g., an administrator account).
3. Inject the encrypted assertion: The attacker replaces the encrypted assertion content within the crafted response with one referencing the target principal's identity, leveraging the fact that Keycloak does not validate the response-level signature when processing encrypted assertions.
4. Submit to Keycloak SAML broker endpoint: The attacker posts the crafted SAML response to Keycloak's SAML broker endpoint (e.g., /realms/{realm}/broker/{idp-alias}/endpoint).
5. Achieve unauthorized access: Keycloak processes the malicious response, accepts the injected encrypted assertion, and establishes a session as the impersonated principal, granting the attacker unauthorized access to applications protected by that Keycloak realm (Red Hat CVE, Red Hat Bugzilla).

• Logs: Keycloak server logs showing SAML broker authentication events for high-privilege accounts from unexpected source IPs or at unusual times; log entries indicating unsigned SAML responses being accepted at the broker endpoint (/realms/{realm}/broker/{idp-alias}/endpoint).
• Logs: Anomalous session creation events in Keycloak audit logs where the authenticated user identity does not match the expected IdP-asserted identity or where the same session originates from multiple principals.
• Network: Unexpected HTTP POST requests to Keycloak SAML broker endpoints containing SAML responses lacking a <ds:Signature> element at the response level but containing <saml:EncryptedAssertion> elements.
• Behavioral: Privileged account logins via SAML federation that do not correspond to known user activity patterns, particularly for administrative or service accounts that would not normally authenticate via the SAML broker.

Red Hat has released patched versions addressing this vulnerability: Red Hat build of Keycloak 26.2.14 (packages: RHSA-2026:3926; images: RHSA-2026:3925) and Red Hat build of Keycloak 26.4.10 (packages: RHSA-2026:3947; images: RHSA-2026:3948). Upstream Keycloak 26.5.5 also includes the fix. Organizations should upgrade to a patched version as the primary remediation. As a temporary workaround, consider requiring signed SAML responses at the IdP level and restricting access to the Keycloak SAML broker endpoint to trusted network sources only (RHSA-2026:3925, RHSA-2026:3947).

Red Hat rated this advisory as "Important" severity and released patches on March 5, 2026, alongside fixes for several other Keycloak SAML-related vulnerabilities. The vulnerability received brief coverage in Java ecosystem news roundups (InfoQ, TechLife Blog) in the week following disclosure. Social media activity was limited, with automated security alert accounts (RedPacketSecurity) sharing the advisory on Mastodon and X. No significant independent researcher commentary or detailed technical write-ups have been published as of the available data (RHSA-2026:3926).