Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.

Etkilenen sürümler8 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-93998 Diğer

Kayıt geçmişi

1. 5 Kas 2026 20:15Yayımlandı

İlgili açıklar

• 7,1 CVE-2026-97847Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim m…
• 8,8 CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
• 6,8 CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
• 8,0 CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
• 8,1 CVE-2026-92857Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
• 7,4 CVE-2026-92855Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession