Verified

ghsa:GHSA-WMXR-6J5F-838P: org.keycloak:keycloak-saml-adapter-core < 26.2.14, >= 26.3.0, < 26.4.10, >= 26.5.0, < 26.5.5; +2 more affected products

Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions. Affected range: < 26.2.14. Fixed version: 26.2.14. Affected range: >= 26.3.0, < 26.4.10. Fixed version: 26.4.10. Affected range: >= 26.5.0, < 26.5.5. Fixed version: 26.5.5. Affected range: >= 26.3.0, < 26.4.10. Fixed version: 26.4.10. Affected range: >= 26.5.0, < 26.5.5. Fixed version: 26.5.5. Affected range: < 26.2.14. Fixed version: 26.2.14. Affected range: >= 26.3.0, < 26.4.10. Fixed version: 26.4.10. Affected range: < 26.2.14. Fixed version: 26.2.14. Affected range: >= 26.5.0, < 26.5.5.

Affected technology

org.keycloak:keycloak-saml-adapter-core · < 26.2.14
Vendor not specified by the source

org.keycloak:keycloak-saml-core · >= 26.3.0, < 26.4.10
Vendor not specified by the source

org.keycloak:keycloak-services · >= 26.5.0, < 26.5.5
Vendor not specified by the source

org.keycloak:keycloak-saml-adapter-core · >= 26.3.0, < 26.4.10
Vendor not specified by the source

org.keycloak:keycloak-saml-adapter-core · >= 26.5.0, < 26.5.5
Vendor not specified by the source

org.keycloak:keycloak-services · < 26.2.14
Vendor not specified by the source

org.keycloak:keycloak-services · >= 26.3.0, < 26.4.10
Vendor not specified by the source

org.keycloak:keycloak-saml-core · < 26.2.14
Vendor not specified by the source

org.keycloak:keycloak-saml-core · >= 26.5.0, < 26.5.5
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. Source advisory’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as low.

Published 12-Oct-2026 10:15 UTC

Product: org.keycloak:keycloak-saml-adapter-core
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-07 02:36:03.777225+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-wmxr-6j5f-838p.html