What is the CVSS score of EUVD-2026-12688?

EUVD-2026-12688 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

How to fix or mitigate EUVD-2026-12688?

Within 24 hours: Audit all Keycloak SAML broker configurations to identify affected deployments; notify security teams and prepare incident response procedures. Within 7 days: Implement network segmentation to restrict SAML broker endpoint access and enable enhanced logging on authentication events; assess whether SAML response signing enforcement is currently enabled. Within 30 days: Monitor Keycloak security advisories for patch availability; evaluate alternative authentication mechanisms or broker providers; conduct forensic analysis of authentication logs for signs of exploitation.

Red Hat Build Of Keycloak 26 4 EUVD-2026-12688

| CVE-2026-2092 HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-03-18 redhat

GHSA-794g-x443-36f7

GHSA-wmxr-6j5f-838p

Authentication Bypass Information Disclosure Red Hat Build Of Keycloak 26 4 Red Hat Build Of Keycloak 26 4 10 Red Hat Build Of Keycloak 26 2 Red Hat Build Of Keycloak 26 2 14 Red Hat

7.7

CVSS 3.1 · Vendor: redhat

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain valid signed SAML assertion
Delivery

Craft unsigned SAML response with encrypted assertion
Exploit

Submit to Keycloak SAML broker endpoint
Execution

Bypass assertion validation
Persist

Authenticate as arbitrary principal
Impact

Gain unauthorized access

Vulnerability Assessment

Weakness	CWE CWE-1287 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V2 - Validation and Business Logic Specified type validation
Exploitation Conditions	Requires Keycloak SAML broker endpoint configured to accept SAML responses. Attacker must possess a valid signed SAML assertion from a federated identity provider. Vulnerable when overall SAML response is unsigned but contains encrypted assertions. Authenticated attacker crafts malicious SAML response with injected encrypted assertion for arbitrary principal.
Impact	The CVSS score of 7.7 (High) reflects a network-accessible attack with high complexity requiring low privileges and no user interaction, with changed scope and high confidentiality impact. The attack complexity is rated high (AC:H) because the attacker needs a valid signed SAML assertion as a prerequisite, limiting opportunistic exploitation. The low privilege requirement (PR:L) indicates the attacker must have authenticated access to obtain a legitimate signed assertion before crafting the malicious response. The changed scope (S:C) indicates potential for cross-boundary impact in federated identity scenarios. No EPSS score or KEV listing is provided in the intelligence data, suggesting no observed active exploitation or public proof-of-concept at time of disclosure. While the CVSS score is elevated, real-world risk is moderated by the prerequisite of obtaining valid signed assertions and the high attack complexity. Organizations using Keycloak as a SAML service provider with external identity federation should prioritize patching, particularly in environments where low-privileged users can authenticate and the confidentiality impact of unauthorized principal impersonation is significant.
Exploit ScenarioDerived	An attacker with low-level authenticated access to a system federated with Keycloak obtains a valid signed SAML assertion through normal authentication. The attacker intercepts or crafts a new SAML response containing their legitimate signed assertion but adds a specially crafted encrypted assertion for a high-privilege principal, such as an administrator account. When submitting this malicious response to Keycloak's SAML broker endpoint without signing the overall response envelope, Keycloak improperly validates the encrypted assertion and grants access as the injected high-privilege principal, bypassing normal authentication controls and enabling unauthorized access to sensitive resources or administrative functions.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

Keycloak's SAML broker endpoint contains a validation flaw that allows attackers with a valid signed SAML assertion to inject encrypted assertions for arbitrary principals when the overall SAML response is unsigned. This leads to authentication bypass and unauthorized access to protected resources. Red Hat build of Keycloak versions 26.2 and 26.4 are affected, with patches available in versions 26.2-16, 26.2.14-1, 26.4-12, and 26.4.10-1. No evidence of active exploitation (not in CISA KEV) has been reported.

RemediationAI

Apply the patches provided by Red Hat for the affected Keycloak versions: upgrade to version 26.2-16 or 26.2.14-1 for the 26.2 branch, or version 26.4-12 or 26.4.10-1 for the 26.4 branch. Detailed patching instructions are available in Red Hat Security Advisories RHSA-2026:3925, RHSA-2026:3926, RHSA-2026:3947, and RHSA-2026:3948 at https://access.redhat.com/errata/. As an interim workaround until patching is completed, organizations should review and restrict SAML broker configurations to only trust well-validated identity providers, implement additional authentication factors for sensitive operations, and monitor authentication logs for anomalous principal assertions or unusual federated login patterns. Consider temporarily disabling SAML brokering for non-critical identity providers if feasible during the patching window.

Affected VersionsENISA

Red Hat build of Keycloak 26.4 patch: 26.4-12

Red Hat build of Keycloak 26.4 patch: 26.4.10-1

Red Hat build of Keycloak 26.2 patch: 26.2.14-1

Red Hat build of Keycloak 26.2 patch: 26.2-16

Affected Packages

maven org.keycloak:keycloak-saml-adapter-core fix: 26.2.14, 26.4.10, 26.5.5

maven org.keycloak:keycloak-saml-core fix: 26.2.14, 26.4.10, 26.5.5

maven org.keycloak:keycloak-services fix: 26.2.14, 26.4.10, 26.5.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects Keycloak's implementation of SAML (Security Assertion Markup Language) identity brokering, specifically in the validation logic for encrypted assertions within SAML responses. The affected products include Red Hat build of Keycloak 26.2 (including 26.2.14) and 26.4 (including 26.4.10) as identified by CPE strings cpe:2.3:a:red_hat:red_hat_build_of_keycloak_26.2 and cpe:2.3:a:red_hat:red_hat_build_of_keycloak_26.4. The root cause falls under CWE-1287 (Improper Validation of Specified Type of Input), where the endpoint fails to properly validate encrypted SAML assertions when the overall response envelope lacks a signature. SAML brokers are used in federated identity scenarios where Keycloak acts as a service provider accepting assertions from external identity providers. The validation weakness allows manipulation of the encryption layer to substitute principal identities even when the original assertion is properly signed.

Know when Red Hat Build Of Keycloak 26 4 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.7 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Red Hat 7.7 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 09, 2026 - 02:30 nvd

Patch available

CVE Published

Mar 18, 2026 - 01:14 nvd

HIGH 7.7

DescriptionCVE.org

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 maven packages depend on org.keycloak:keycloak-saml-adapter-core (4 direct, 1 indirect)
29 maven packages depend on org.keycloak:keycloak-saml-core (8 direct, 21 indirect)
50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.3.0 and other introduced versions.

Executive ViewAI

Why It Matters

Keycloak's SAML authentication broker contains a critical validation flaw that allows attackers to bypass authentication controls and gain unauthorized access to systems relying on SAML identity federation. This vulnerability directly threatens any organization using Keycloak for single sign-on or identity management, potentially compromising user accounts and sensitive data across integrated applications.

Business Impact: Severe

Compensating Controls

Enforce mandatory SAML response signing at the application level (disable unsigned response acceptance); implement Web Application Firewall (WAF) rules to detect malformed SAML assertions; restrict network access to SAML broker endpoints to known identity providers only; consider temporarily disabling SAML broker functionality if business requirements permit; enable comprehensive audit logging and alerting on SAML authentication failures; implement strict certificate pinning for SAML assertion validation.

Threat Intelligence Overview

EPSS Score

0.1%

Top 79% exploitable

Threat Intel

1 source

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.