SAML Assertion Replay Vulnerability in Keycloak Identity Management
CVE-2026-18967

6.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 August 2026

What is CVE-2026-18967?

A vulnerability exists in Keycloak's SAML broker component where the OneTimeUse condition in SAML assertions is not enforced when using the IdP-Initiated flow. This oversight allows attackers to capture valid, unused assertions and reuse them to hijack user sessions, potentially granting unauthorized access to the system. Proper configuration and timely updates are crucial to protect against this risk.

References

https://access.redhat.com/security/cve/CVE-2026-18967
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511604
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Lidor Vasker for reporting this issue.
.