Keycloak SAML Adapter Issuer Mismatch (CVE-2026-93998)
CVE-2026-93998 Published on November 5, 2026

Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.

NVD

Vulnerability Analysis

CVE-2026-93998 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 48 days later.

Weakness Type

Improper Verification of Cryptographic Signature

The software does not verify, or incorrectly verifies, the cryptographic signature for data.


Products Associated with CVE-2026-93998

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Amq Broker
 
Red Hat Build Keycloak
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Satellite
 
Red Hat Single Sign On
 

Affected Versions

Red Hat AMQ Broker 7: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Satellite 6: Red Hat Single Sign-On 7: