Bug 2537164 (CVE-2026-93998)

Summary: CVE-2026-93998 keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, csuconic, dbruscin, dlofthou, drichtar, ehelms, gmalinko, gtully, istudens, ivassile, iweiss, janstey, jpasqual, jsherman, juwatts, kvanderr, lblicha, mhulan, mosmerov, mposolda, msvehla, nwallace, ogajduse, osousa, pberan, pdelbell, pesilva, pjindal, pmackay, rchan, rgemmell, rgodfrey, rmartinc, rstancel, rstepani, security-response-team, smallamp, ssilvert, sthorger, tbish, thjenkin, tlavocat, vdosoudi, vmuzikar, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-17   

Description OSIDB Bzimport 2026-09-19 13:56:04 UTC 
A flaw was found in the Keycloak SAML adapter, specifically within the assertion validation logic in the org.keycloak.adapters.saml.profile package. The adapter accepts signed SAML Responses and Assertions without verifying that the Issuer field matches the configured identity provider entity ID.
In environments where a single signing key is shared across multiple SAML issuers or tenants, an attacker who controls a sibling issuer can generate a SAML assertion signed with the shared key. By addressing this assertion to the victim application's audience and consumer service, the attacker can bypass authentication.
Successful exploitation allows an attacker to impersonate any principal within the application, gain unauthorized administrative access by including specific roles in the assertion, and access or modify sensitive data and configurations within the protected application.
Exploitation requires that the application trusts a signing key used by more than one issuer and that the attacker has the ability to produce assertions signed with that key.