# CVE-2026-92855: Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession Status: published. Published: 2026-11-05. Updated: 2026-11-09. A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key. ## Remediation - workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce proof of possession for bound keys in SAML identity broker subject-confirmation validation: upgrade to Keycloak 26.4.17 / 26.6.8 (or the corresponding fixed Red Hat builds), which enforce proof of possession for the bound key or reject assertions that contain only unvalidated holder-of-key confirmations, closing replaying intercepted SAML holder-of-key assertions. Until patched, this is a concern on Keycloak deployments configured as a SAML identity broker trusting upstream providers that issue holder-of-key assertions, so restrict and audit trusted upstream SAML identity providers issuing holder-of-key assertions to prevent interception and unauthorized replay of signed assertions. As a compensating measure, enforce mandatory secondary authentication factor in Keycloak post-federation to block login completion on replayed assertions. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing proof-of-possession verification flaw — apply the upstream patch to fully remediate. Highest-impact CME: CME-801 Multi-Factor Authentication (MFA) (medium) (source: CNA: redhat) ## Affected products and versions - Red Hat / Red Hat build of Keycloak 26.4 (rhbk/keycloak-operator-bundle): ≥ 26.4.17-2; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.4 (rhbk/keycloak-rhel9): ≥ 26.4-29; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.4 (rhbk/keycloak-rhel9-operator): ≥ 26.4-30; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.4.17 (keycloak/rhbk-openshift-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.4.17 (keycloak-services): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.4.17 (rhbk/keycloak-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.6 (rhbk/keycloak-operator-bundle): ≥ 26.6.8-2; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.6 (rhbk/keycloak-rhel9): ≥ 26.6-24; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.6 (rhbk/keycloak-rhel9-operator): ≥ 26.6-24; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.6.8 (keycloak/rhbk-openshift-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.6.8 (keycloak-services): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat build of Keycloak 26.6.8 (rhbk/keycloak-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Single Sign-On 7 (keycloak-services): Version range not reported. Source: CNA: redhat ## Severity and prioritization - CVSS 3.1: 7.4 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; source: CNA: redhat - CVSS 3.1: 7.4 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; source: NVD: secalert@redhat.com - CISA KEV: No listing in collected sources - EPSS: 0.41% as of 2026-11-09; percentile 35.76% - SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP - Weaknesses: CWE-287 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://access.redhat.com/errata/RHSA-2026:95759 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:95760 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:95761 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:95762 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/security/cve/CVE-2026-92855 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://bugzilla.redhat.com/show_bug.cgi?id=2535814 (CNA: redhat; issue-tracking, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:95759 (secalert@redhat.com) - https://access.redhat.com/errata/RHSA-2026:95760 (secalert@redhat.com) - https://access.redhat.com/errata/RHSA-2026:95761 (secalert@redhat.com) - https://access.redhat.com/errata/RHSA-2026:95762 (secalert@redhat.com) - https://access.redhat.com/security/cve/CVE-2026-92855 (secalert@redhat.com) - https://bugzilla.redhat.com/show_bug.cgi?id=2535814 (secalert@redhat.com) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-92855; retrieved 2026-11-09; source updated 2026-11-09 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92855; retrieved 2026-11-10; source updated 2026-11-09 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-92855; retrieved 2026-11-09; source updated Not reported Revision: 0f83eed4c29017da5c1600cafa2264c5340d80cde8ad0b77581094127f87a365 Canonical: https://y2.dev/cve/CVE-2026-92855 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.