Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions if the entire SAML response is unsigned. This flaw enables an attacker possessing a valid signed SAML assertion to inject a malicious encrypted assertion for any principal by crafting a specially formed SAML response. The vulnerability can result in unauthorized access and potential information disclosure. The affected versions are prior to 26.2.14, versions from 26.3.0 up to but not including 26.4.10, and versions from 26.5.0 up to but not including 26.5.5.

Successful exploitation allows an attacker with a valid signed SAML assertion to gain unauthorized access by injecting encrypted assertions for arbitrary principals. This can lead to unauthorized access to protected resources and potential information disclosure. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor vendor communications for updates and apply any official fixes once available. Until then, consider restricting access to the SAML broker endpoint or implementing additional validation controls if feasible.