REDHAT-BUG-2535814: High severity Keycloak Keycloak vulnerability

A flaw was found in the org.keycloak.broker.saml package of Keycloak. The SAML identity broker incorrectly handles signed assertions that contain only a holder-of-key SubjectConfirmation. When a bearer confirmation is absent, the broker skips the necessary subject-confirmation validation instead of enforcing proof of possession for the bound key. Exploitation requires that Keycloak is configured as a SAML broker with a trusted upstream provider that issues holder-of-key assertions. An attacker must obtain a valid signed assertion issued for a victim. No authentication or user interaction is required for the replay attack. Successful exploitation allows an attacker to bypass authentication mechanisms, impersonate any victim for whom they have a valid assertion, gain full access to the victim account and downstream applications, and issue new downstream assertions for the victim identity.