Vulnerability in Keycloak Identity and Access Management Solution
CVE-2026-92856

4.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 November 2026

What is CVE-2026-92856?

A vulnerability exists in the SAML brokering component of Keycloak, affecting its role as an intermediary between upstream identity providers and downstream services. The flaw arises from Keycloak's failure to enforce ProxyRestrictions detailed in the login messages it processes. Consequently, this oversight can enable users to access downstream services even when the upstream identity provider has explicitly prohibited such access. This flaw undermines intended security boundaries and may lead to unintended use of user identities across systems.

References

https://access.redhat.com/security/cve/CVE-2026-92856
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2535815
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank yd1ng for reporting this issue.
.