CVE-2026-2092 describes a security flaw in Red Hat build of Keycloak 26.2 where the SAML broker endpoint does not properly validate encrypted assertions if the overall SAML response is unsigned. This improper validation allows an attacker possessing a valid signed SAML assertion to craft a malicious SAML response that injects an encrypted assertion for an arbitrary principal. The flaw can lead to unauthorized access and potential information disclosure. The vulnerability is categorized under CWE-1287. Red Hat has published security advisories and released updated Keycloak 26.2.14 images that fix this issue.

The vulnerability allows attackers to bypass authentication controls by injecting encrypted assertions for arbitrary principals, resulting in unauthorized access to systems protected by Keycloak. This can lead to information disclosure and compromise of confidentiality, integrity, and availability of affected systems. The CVSS 3.1 base score is 7.7, indicating a high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and scope change with high confidentiality impact, low integrity impact, and low availability impact.

Red Hat has released version 26.2.14 of the Red Hat build of Keycloak which addresses this vulnerability. Users should upgrade to version 26.2.14 or later to remediate the issue. Before applying the update, it is recommended to back up existing installations, including applications, configuration files, and databases. No other mitigations are specified in the vendor advisory. Patch status is confirmed as fixed in 26.2.14.