Improper Validation of Specified Type of Input in Keycloak - CVE-2026-2092
Published: June 1, 2026 / Updated: September 10, 2026
Vulnerability identifier: #VU133121
CSH Severity: Low
CVSS v4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-2092
CWE-ID: CWE-1287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access and disclose sensitive information.
The vulnerability exists due to improper validation of specified type of input in the SAML broker endpoint when processing encrypted assertions in an unsigned SAML response. A remote user can craft a malicious SAML response containing an encrypted assertion for an arbitrary principal to gain unauthorized access and disclose sensitive information.
Exploitation requires a valid signed SAML assertion.
Affected software
Keycloak
Optim
Red Hat build of Keycloak
Optim
Red Hat build of Keycloak
How to mitigate CVE-2026-2092
Install security update from vendor's website.
Keycloak - addressed in versions 26.2.14, 26.4.10, 26.5.5, 26.6.0
Optim - update to 2.0.0
Red Hat build of Keycloak - addressed in versions 26.2.14, 26.4.10
Optim - update to 2.0.0
Red Hat build of Keycloak - addressed in versions 26.2.14, 26.4.10