Vulnerability details
CVE-2026-92855
Red Hat Single Sign-On 7
Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession
CVSS 3.1
7.4High
Official description
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.4High | 3.1 | CVEProject cvelistV5 (CNA) (redhat) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat Single Sign-On 7 | All | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://access.redhat.com/errata/RHSA-2026:95759 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95760 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95761 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95762 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-92855 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2535814 issue-trackingx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-05
- Last updated
- 2026-11-06
- State
- Published
- Assigner (CNA)
- redhat
Exploit prediction (EPSS)
0.41%
Probability of exploitation in 30 days
35.7%
Percentile (among all CVEs)
Weaknesses (CWE)
- CWE-287Improper Authentication