In Keycloak’s SAML identity broker, an assertion bearing a holder‑of‑key credential can be accepted even when the broker does not confirm that the holder actually possesses the matching private key. An attacker who captures such a signed assertion can replay it to the broker and gain authentication as the legitimate user. The flaw enables an impersonation attack that bypasses the intended cryptographic protection of the SAML protocol and is classified as CWE‑287 (Improper Authentication).

The vulnerability affects Red Hat Build of Keycloak and Red Hat Single Sign‑On 7, the enterprise distributions of the Keycloak identity broker used by Red Hat customers.

The CVSS score of 7.4 indicates a high severity for authentication bypass. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no current evidence of active exploitation. Likely attack vectors involve an adversary intercepting a signed SAML assertion—through network sniffing, session hijacking, or other means—then replaying it to the Keycloak broker to spoof the user. Because the broker does not validate key possession, the attack does not require the private key, making it relatively straightforward once an assertion is captured.