fr.cnieg.keycloak:attribute-login-provider (1.3.4), io.phasetwo.keycloak:keycloak-orgs (>=0.24, <=0.27) +25 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (21.0.2)

org.keycloak:keycloak-services MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.4 - io.phasetwo.keycloak:keycloak-orgs =0.24, =2.5,...

io.kokuwa.keycloak:keycloak-event-metrics (0.2.1), org.keycloak:keycloak-crypto-fips1402 (21.1.0) +13 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (21.1.0)

org.keycloak:keycloak-services MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 0.2.1 - org.keycloak:keycloak-crypto-fips1402 21.1.0 -...

com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider (1.0.0), io.github.pckhoi.keycloak:webhook (19.0.2.1) +19 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (19.0.2)

org.keycloak:keycloak-services MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider 1.0.0 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=1.1.0-22.0.1, <=1.3.2-22.0.1), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=1.1.0-22.0.1, <=1.3.2-22.0.1) +29 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (22.0.1)

org.keycloak:keycloak-services MAVEN version 22.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =1.1.0-22.0.1, =1.1.0-22.0.1, =1.0.1, =1.0.2 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.7), org.keycloak:keycloak-crypto-fips1402 (22.0.2) +13 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (22.0.2)

org.keycloak:keycloak-services MAVEN version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.7 - org.keycloak:keycloak-crypto-fips1402 22.0.2 -...

fr.cnieg.keycloak:attribute-login-provider (>=1.3.9, <=1.3.10), io.phasetwo.keycloak:keycloak-events (>=0.21, <=0.22) +20 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (22.0.5)

org.keycloak:keycloak-services MAVEN version 22.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider =1.3.9, =0.21, =0.44, =0.46 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.11), io.github.jeff-tian:keycloak-services-social-weixin (>=0.5.35, <=0.5.40) +15 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (23.0.0)

org.keycloak:keycloak-services MAVEN version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.11 -...

com.charlyghislain.keycloak:keycloak-importexport (23.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.13) +26 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (23.0.3)

org.keycloak:keycloak-services MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 23.0.1 -...

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading...

EUVD-2026-12688

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-dependencies-server-min (4.3.0.final) +3 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (4.3.0.final)

org.keycloak:keycloak-services MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

org.keycloak:keycloak-authz-policy-drools (2.1.0.final), org.keycloak:keycloak-dependencies-server-all (2.1.0.final) +3 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.1.0.final)

org.keycloak:keycloak-services MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.1.0.final -...

org.keycloak:keycloak-authz-policy-drools (2.5.5.final), org.keycloak:keycloak-dependencies-server-all (2.5.5.final) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.5.5.final)

org.keycloak:keycloak-services MAVEN version 2.5.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.5.final -...

org.keycloak:keycloak-authz-policy-drools (2.5.4.final), org.keycloak:keycloak-dependencies-server-all (2.5.4.final) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.5.4.final)

org.keycloak:keycloak-services MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.4.final -...

org.keycloak:keycloak-authz-policy-drools (2.5.1.final), org.keycloak:keycloak-dependencies-server-all (2.5.1.final) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.5.1.final)

org.keycloak:keycloak-services MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.1.final -...

org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

org.keycloak:keycloak-authz-policy-drools (2.5.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.5.0.cr1) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.5.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.cr1 -...

org.keycloak:keycloak-authz-policy-drools (2.4.0.final), org.keycloak:keycloak-dependencies-server-all (2.4.0.final) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.4.0.final)

org.keycloak:keycloak-services MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.4.0.final -...

org.keycloak:keycloak-authz-policy-drools (2.4.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.4.0.cr1) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.4.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.4.0.cr1 -...

org.keycloak:keycloak-authz-policy-drools (2.3.0.final), org.keycloak:keycloak-dependencies-server-all (2.3.0.final) +5 more potentially affected by CVE-2026-2092 via org.keycloak:keycloak-services (2.3.0.final)

org.keycloak:keycloak-services MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.3.0.final -...