{"id":"EM-20261106-5VX1","url":"https://cyber.eventmonitor.net/incident/EM-20261106-5VX1/saml-vulnerability-cve-2026-92856/","type":"cve","title":"SAML Vulnerability (CVE-2026-92856)","subtitle":"CVE-2026-92856","subject":"CVE-2026-92856","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-06T06:30:23.000Z","firstSignal":"2026-11-05T00:00:00.000Z","lastSignal":"2026-11-06T06:30:23.000Z","updated":"2026-11-06T07:34:48.209Z","revision":1,"life":[{"status":"Born","at":"2026-11-06T06:30:23.000Z","why":"second independent source: C29 CIRCL Vulnerability-Lookup"},{"status":"Developing","at":"2026-11-06T06:30:23.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T00:00:00.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-06T06:30:23.000Z","what":"Born: second source, C29 CIRCL Vulnerability-Lookup. Page EM-20261106-5VX1 created."}],"stages":[{"name":"Disclosed","at":"2026-11-06T06:16:44.747Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-06T06:16:44.747Z","detail":"CVSS 4.9"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T00:00:00.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T00:00:00.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-92856 (moderate)","text":"keycloak-services: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-92856.json"},{"at":"2026-11-06T06:30:23.000Z","source":"C29","sourceName":"CIRCL Vulnerability-Lookup","role":"Database","severity":2,"title":"GHSA-p9f7-q656-992q / CVE-2026-92856","text":"A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called…","url":"https://vulnerability.circl.lu/vuln/GHSA-p9f7-q656-992q"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-06T06:16:44.747","score":4.9,"severity":"MEDIUM","desc":"A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called…","product":"","seen":1793950488209},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}