Keycloak 26.8.1 and 26.8.2: 52 CVEs, SAML Broker Login as Any User

SAML Broker Signature Bypasses: Login as Any User #

When Keycloak brokers a login to an external SAML identity provider over the HTTP-Redirect binding, the signature covers the query string. The 26.8.1 notes list weakness #53354: the signature was verified over a different SAMLResponse than the one Keycloak processed, using ; as a parameter separator, which allowed an unauthenticated login as an arbitrary user. That entry carries no CVE, only the identifier ANT-2026-HQ54RPF9. About three weeks later, 26.8.2 fixed CVE-2026-117691, the same outcome through a percent-encoded parameter name, %53AMLResponse.

26.8.2 fixes three more SAML trust problems: the broker accepted holder-of-key assertions without proof of key possession (CVE-2026-92855), it ignored ProxyRestriction (CVE-2026-92856), and the SAML adapter accepted assertions from the wrong configured issuer (CVE-2026-93998, CVSS 7.4). A realm without a SAML identity provider or SAML adapter is outside these four.

Account Takeover and Session Hijacking Paths in 26.8.2 #

• CVE-2026-112208 (CVSS 8.1): a stale SSO_AUTH note in organization identity-first login allows account takeover; the notes say it was reproduced on 26.8.1.
• CVE-2026-103112 (7.5): account takeover through a race in authentication.
• CVE-2026-97175: an identity provider email that was never verified can be auto-linked to an existing account.
• CVE-2026-92857 (8.1): a protocol mapper that dynamic client registration allows by default can write the reserved sub and aud claims, which spoofs identities.
• CVE-2026-97174 (6.8): an injected sub parameter in CIBA makes the attacker's authentication issue the victim's tokens.
• CVE-2026-107124 (6.4) and CVE-2026-97367 (6.4): session takeover through a victim logout with an injected id_token_hint, and through azp and sid claim substitution by User Property mappers in dynamic client registration.
• CVE-2026-96447: a stateless token's preferred_username fallback rebinds identities after a client is recreated.

Several of these depend on dynamic client registration, organizations or CIBA, which not every realm enables. The account takeover through organization login and the authentication race carry the highest scores.

Delegated Admins Escalating to realm-admin #

Both releases fix ways for a limited administrator to gain more rights. In 26.8.1, CVE-2026-94000 let a delegated admin with only manage-users become realm-admin by joining, or being created into, a group that maps an admin role. CVE-2026-94001 and CVE-2026-97177 bypassed a denied reset-password permission through credential deletion and a generic user update. In 26.8.2, a client manager could replace a sessionless token principal and take over the realm (CVE-2026-97847, 7.1). Fine-grained admin permissions v2 let manage-users assign a composite role that wraps realm-admin (CVE-2026-96448). A principal with only create-client could add a role to the realm's default roles (CVE-2026-109081, 6.8). CVE-2026-96457 restores a group-admin deny that a top-level move bypassed, a regression of CVE-2026-9099.

Unauthenticated Denial of Service Through SAML and Themes #

26.8.2 fixes five ways to take Keycloak down without logging in, four of them scored 7.5. A legal ds:KeyName in SAML 1.1 sends the KeyInfo parser into a loop that exhausts CPU and the worker pool until a restart (CVE-2026-107602). A single request ends the JVM with an OutOfMemoryError through the SAML 1.1 AuthorityBinding parser, an incomplete fix of CVE-2026-7307 (CVE-2026-110931). The SAML endpoint has a further denial of service (CVE-2026-107123), and the theme gzip cache on 26.8.0 and older can fill the disk permanently (CVE-2026-110932). The SOAP endpoint at /realms/{realm}/protocol/saml/resolve parses unbounded XML (CVE-2026-82965). 26.8.2 also updates the bundled Brotli decoder for CVE-2026-111497.

All 52 CVEs by Release #

The two tables list every CVE in the security fixes of each release, with the component label the release notes give.

26.8.1 also lists weaknesses without CVEs, among them a reusable organization invitation link, username enumeration through empty-password timing, an X.509 KeyUsage mismatch that bypassed policy, and a fine-grained permissions v2 role injection that was an incomplete fix for CVE-2026-4629. One of its bug entries concerns the masking of the authenticator reference after the CVE-2026-16104 fix.

Upgrading Keycloak and Closing the Exposed Paths #

1. Install 26.8.2 on every node; it contains the 26.8.1 fixes. A 26.7 installation is affected too, since the 26.8.1 notes report the PAR bypass on 26.7.3, so move it to 26.8.2.
2. Until the update, review every SAML identity provider in each realm and disable the ones that are not needed; for the rest, compare recent broker logins with the users who actually signed in at that provider.
3. Restrict dynamic client registration with client registration policies, or turn anonymous registration off, since four of the 26.8.2 CVEs run through it.
4. List which groups map admin roles and which delegated admins hold manage-users, create-client or client manager rights, and remove assignments nobody needs.
5. Rebuild container images and Keycloak operator deployments with the new version, then check that SMTP settings with starttls=true still deliver mail, since 26.8.1 closed the plaintext downgrade that starttls=true allowed.

Checking a Keycloak Realm for the Affected Features #

The admin CLI shows the version, the identity providers by type and the client registration policies, which decide whether the SAML and dynamic client registration CVEs apply.

/opt/keycloak/bin/kc.sh --version
kcadm.sh get identity-provider/instances -r REALM --fields alias,providerId,enabled
kcadm.sh get components -r REALM -q type=org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy --fields name,providerId,subType
kcadm.sh get groups -r REALM --fields name,realmRoles