CVE-2026-93998highCWE-347

CVE-2026-93998: high-severity vulnerability in Red Hat AMQ Broker 7

Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer

Published · Updated

Follow this CVE+ Monitor Red Hat build of Keycloak+ Monitor Red Hat Single Sign-On

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 0.3%
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Red Hat · Red Hat AMQ Broker 7Red Hat · Red Hat build of Keycloak 26.4Red Hat · Red Hat build of Keycloak 26.4.17Red Hat · Red Hat build of Keycloak 26.6Red Hat · Red Hat build of Keycloak 26.6.8Red Hat · Red Hat Fuse 7Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Satellite 6Red Hat · Red Hat Single Sign-On 7
Related CVEs — Red Hat AMQ Broker 7

In the same product, most dangerous first.

CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 6.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.9%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.4%CVE-2026-93574MEDIUMIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingEPSS 1.7%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2024-1132HIGHKeycloak: path transversal in redirection validationEPSS 1.6%