CVEvulnerability

CVE-2026-18967

8.1 HIGH Published 2026-08-06 Modified 2026-08-10 Official page ↗
Status
Analyzed
Published
2026-08-06
Last modified
2026-08-10
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.4 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-294

Description

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.

Affected configurations

• redhat build of keycloak • redhat jboss enterprise application platform expansion pack

Related

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References