← לוח פגיעויות

CVE-2026-2092

גבוהה 7.7

תיאור (מקור, אנגלית)

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

מדדים

CVSS 3.1
7.7 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS — סבירות ניצול
0% (אחוזון 000) נכון ל-23/9/2026
CWE
CWE-1287

מוצרים מושפעים

redhat: build of keycloak

קישורים