CVE-2026-92855highCWE-287

CVE-2026-92855: fallo de gravedad alta en Red Hat build of Keycloak 26.4

Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat build of Keycloak+ Monitorear Red Hat Single Sign-On

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.4%
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Red Hat · Red Hat build of Keycloak 26.4Red Hat · Red Hat build of Keycloak 26.4.17Red Hat · Red Hat build of Keycloak 26.6Red Hat · Red Hat build of Keycloak 26.6.8Red Hat · Red Hat Single Sign-On 7
CVEs relacionadas — Red Hat build of Keycloak 26.4

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 6.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.9%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.4%CVE-2026-93574MEDIUMIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingEPSS 1.7%CVE-2026-93558HIGHIo.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of serviceEPSS 1.2%CVE-2026-93579MEDIUMIo.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)EPSS 1.1%