CVE-2026-18967

Published: Aug 6, 2026Modified: Aug 10, 2026

8.1

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.

Affected (2)

Products: Redhat: Build Of Keycloak, Jboss Enterprise Application Platform Expansion Pack

2 products

Build Of Keycloak

Jboss Enterprise Application Platform Expansion Pack

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Keycloak	All versions
Redhat Jboss Enterprise Application Platform Expansion Pack	All versions

Related CWEs

Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (2)

https://access.redhat.com/security/cve/CVE-2026-18967

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2511604

Source: secalert@redhat.com

Permissions Required

Timeline

No history available yet.