The SAML adapter in Keycloak does not verify that the issuer of a signed SAML assertion matches the identity provider that the application expects. This allows an attacker who can control an identity provider that shares a signing key with a trusted provider to forge a signed assertion and log in as any user, including administrators, gaining full control over the application.

Red Hat products such as Red Hat AMQ Broker 7, Red Hat Build of Keycloak, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8, Red Hat Single Sign‑On 7, and Red Hat Satellite 6 are affected. Specific version ranges are not listed in the advisory; administrators should check the vendor reference for exact impacted releases.

The CVSS score of 7.4 indicates a high severity vulnerability. EPSS is not available, but the risk remains significant because exploitability requires control over a trustworthy identity provider that shares the signing key. The vulnerability is not listed in the CISA KEV catalog. An attacker with access to a compromised or malicious IDP can craft legitimate assertions, thereby bypassing authentication and achieving elevated privileges.