CVE-2026-1190CWE-112

Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata

Low · published January 26, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.7th percentile
Weakness
CWE-112 · Missing XML Validation
Published
2026-01-26T19:36Z
EPSS history
Timeline
  • 26 JAN 19:36Z
    Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata
    cvelistv5