EUVD-2026-53343
GHSA-v5j7-jp89-37vr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated SAML forgery (AV:N/PR:N/UI:N); low complexity given disabled validation, though it needs a specific misconfigured IdP; full account takeover impacts C and I, not availability.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
AnalysisAI
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Keycloak realm to be configured with an external SAML identity provider whose metadata was imported WITHOUT explicit key-usage (use="signing") attributes on its <KeyDescriptor>, which is the specific misconfiguration that causes signature validation to be disabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and must be weighed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker learns the external identifier (e.g., the NameID/username a victim uses at the federated SAML IdP) of a target user in a Keycloak realm whose external IdP metadata was imported without key-usage attributes. Because signature validation is silently disabled, the attacker crafts a forged, unsigned SAML response asserting that identity and submits it to Keycloak's broker endpoint, and is logged in as the victim with no credentials or MFA. … |
| Remediation | Vendor-released patch: upgrade Red Hat Build of Keycloak to 26.6.5-1 (or 26.6-11) or 26.4.14-1 (or 26.4-22) per RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849 (https://access.redhat.com/errata/RHSA-2026:50846); apply the corresponding Red Hat Single Sign-On 7, JBoss EAP Expansion Pack, and Data Grid 8 errata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Red Hat Build of Keycloak or Red Hat Single Sign-On 7 and audit their SAML identity-provider configurations to determine exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today