← Volver a CVEs

CVE-2026-2092

HIGH

7.7

Descripcion

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Detalles CVE

Puntuacion CVSS v3.17.7

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/18/2026

Ultima modificacion3/18/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-1287

Referencias

https://access.redhat.com/errata/RHSA-2026:3925(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2026:3926(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2026:3947(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2026:3948(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2026-2092(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2437296(secalert@redhat.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.