A flaw was found in the Keycloak SAML adapter, specifically within the assertion validation logic in the org.keycloak.adapters.saml.profile package. The adapter accepts signed SAML Responses and Assertions without verifying that the Issuer field matches the configured identity provider entity ID.
In environments where a single signing key is shared across multiple SAML issuers or tenants, an attacker who controls a sibling issuer can generate a SAML assertion signed with the shared key. By addressing this assertion to the victim application's audience and consumer service, the attacker can bypass authentication.
Successful exploitation allows an attacker to impersonate any principal within the application, gain unauthorized administrative access by including specific roles in the assertion, and access or modify sensitive data and configurations within the protected application.
Exploitation requires that the application trusts a signing key used by more than one issuer and that the attacker has the ability to produce assertions signed with that key.