Description

A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-11-05T18:17:10.707Z",
  "pubdate": "2026-11-05T18:17:10.707Z",
  "executiveSummary": "A critical security flaw exists in the SAML identity broker component of Keycloak, characterized as an improper verification of proof-of-possession (holder-of-key) assertions.\nThe vulnerability allows an unauthenticated attacker to bypass authentication mechanisms by replaying intercepted signed SAML assertions.\nBecause the broker component fails to mandate proof that the presenter of the assertion holds the associated private key, an attacker can effectively impersonate any legitimate user within the identity provider ecosystem.\nThis vulnerability poses a significant risk to the integrity of identity federation, as it enables unauthorized access to protected resources and services without requiring the victim's cryptographic credentials.\nSuccessful exploitation requires the attacker to intercept a valid, signed SAML assertion, which can be accomplished through network-level interception, such as man-in-the-middle (MITM) attacks, or by accessing logs where assertions might be improperly cached or exposed.\nThe vulnerability affects Keycloak deployments utilizing the SAML identity broker functionality. The lack of cryptographic verification represents a failure in the SAML processing pipeline, undermining the security guarantees of the holder-of-key binding.",
  "technicalDetails": "The root cause of this vulnerability lies in the SAML identity broker's failure to enforce cryptographic proof-of-possession when processing holder-of-key assertions.\nIn the SAML specification, a holder-of-key assertion is designed to bind the assertion to the presenter. This binding requires that the presenter demonstrate possession of the private key corresponding to the public key embedded within the SAML SubjectConfirmationData.\nThe Keycloak SAML broker component performs validation of the assertion's signature to ensure integrity and authenticity; however, it fails to verify that the requestor actually possesses the corresponding private key at the transport or application layer.\nAn attacker can initiate the following attack flow: 1) The attacker intercepts a valid, signed SAML assertion during a legitimate authentication transaction between a victim and the identity provider. 2) The attacker submits this intercepted assertion to the Keycloak instance acting as a service provider or broker. 3) Because Keycloak validates the signature of the assertion but ignores the holder-of-key binding requirement, the assertion is treated as a valid authentication token. 4) The broker grants the attacker an authenticated session associated with the identity and privileges of the victim.\nThis exploitation technique bypasses the intended requirement for the client to perform a mutual TLS (mTLS) handshake or other cryptographic challenge-response mechanism that would normally authenticate the client's hold of the private key.\nThe vulnerability is primarily located within the SAML processing logic of the identity broker component. Since the broker consumes these assertions to delegate authentication, the failure to perform binding validation effectively renders the authentication process vulnerable to replay-based identity spoofing.\nThere are no specific privileges required for the attacker to perform this exploit, provided they possess the intercepted assertion. The network exposure is broad, as any identity provider connected to the vulnerable Keycloak broker can be leveraged as an injection point.\nPost-exploitation, the attacker gains full authenticated access to the target system as the victim, allowing for unauthorized data access, modification, or lateral movement within the environment, depending on the victim's permissions and role assignments."
}