Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.

Etkilenen sürümler2 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-92855 Diğer

Kayıt geçmişi

1. 5 Kas 2026 20:15Yayımlandı

İlgili açıklar

• 7,1 CVE-2026-97847Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim m…
• 8,8 CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
• 6,8 CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
• 8,0 CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
• 7,4 CVE-2026-93998Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
• 8,1 CVE-2026-92857Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens