CVE-2026-18967CWE-294

CVE-2026-18967

Medium · published August 6, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2026-08-06T11:16Z
Affected products (2)
ProductVersionsFixed in
redhat/build_of_keycloakall versions—
redhat/jboss_enterprise_application_platform_expansion_packall versions—
References (2)
https://access.redhat.com/security/cve/CVE-2026-18967 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2511604 · [email protected]
EPSS history
Timeline
  • 06 AUG 05:33Z
    Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow
    cvelistv5