GitHub Advisoryadvisory · Maven

GHSA-63v5-26vq-m4vm Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

LOW Published 2026-01-26 Modified 2026-03-06 Official page ↗
Aliases
CVE-2026-1190
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-112, CWE-347, CWE-613
Reviewed
2026-01-27

Affected packages

• Maven org.keycloak:keycloak-services: <= 26.5.2 (no fix yet)

Description

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2026-1190 A flaw was found in Keycloak's SAML brokering functionality. vulnerability

Weakness · CWE (2)

  • CWE-112 Missing XML Validation weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References