CVE-2026-93998

HIGH 7.4

Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.

CWE	CWE-347
Vendor	red hat
Product	red hat amq broker 7
Published	Nov 5, 2026
Last Updated	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat amq broker 7

Be the first to know when new high vulnerabilities affecting red hat red hat amq broker 7 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None