CVE-2026-18967: Authentication Bypass by Capture-replay in Red Hat Red Hat Build of Keycloak
A vulnerability in the SAML broker component of Keycloak allows replay of SAML assertions when using the IdP-Initiated flow. The flaw is due to failure to enforce the OneTimeUse condition, enabling attackers who capture a valid assertion to reuse it multiple times. This can lead to session hijacking and unauthorized access. The vulnerability has a moderate severity score of 6.4 and requires the attacker to capture a valid assertion and replay it within a limited time window. No official patch or mitigation is currently available from Red Hat.
AI Analysis
Technical Summary
CVE-2026-18967 is a vulnerability in Keycloak's SAML broker component when configured with the IdP-Initiated flow. The system fails to enforce the OneTimeUse condition on SAML assertions, allowing an attacker who captures a valid, unused assertion to replay it multiple times. This replay attack can result in hijacking a user's session and gaining unauthorized access with that user's privileges. The root cause is the lack of recording and checking of SAML assertion IDs to enforce the OneTimeUse condition. The vulnerability is rated moderate with a CVSS 3.1 base score of 6.4 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).
Potential Impact
Successful exploitation allows an attacker to hijack a user's session and perform actions with the user's privileges. Exploitation requires capturing a valid SAML assertion and replaying it within a specific time window. The vulnerability affects only the IdP-Initiated broker flow in Keycloak. There is no impact on availability. The attack complexity is high and user interaction is required.
Mitigation Recommendations
According to the Red Hat advisory, no mitigation is currently available that meets criteria for ease of use, applicability, or stability. Users should monitor vendor advisories for future patches or fixes. Until a fix is released, organizations should be aware of the risk associated with the IdP-Initiated SAML broker flow and consider limiting its use or implementing compensating controls where possible.
CVE-2026-18967: Authentication Bypass by Capture-replay in Red Hat Red Hat Build of Keycloak
Description
A vulnerability in the SAML broker component of Keycloak allows replay of SAML assertions when using the IdP-Initiated flow. The flaw is due to failure to enforce the OneTimeUse condition, enabling attackers who capture a valid assertion to reuse it multiple times. This can lead to session hijacking and unauthorized access. The vulnerability has a moderate severity score of 6.4 and requires the attacker to capture a valid assertion and replay it within a limited time window. No official patch or mitigation is currently available from Red Hat.
CVSS v3.1
Score 6.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18967 is a vulnerability in Keycloak's SAML broker component when configured with the IdP-Initiated flow. The system fails to enforce the OneTimeUse condition on SAML assertions, allowing an attacker who captures a valid, unused assertion to replay it multiple times. This replay attack can result in hijacking a user's session and gaining unauthorized access with that user's privileges. The root cause is the lack of recording and checking of SAML assertion IDs to enforce the OneTimeUse condition. The vulnerability is rated moderate with a CVSS 3.1 base score of 6.4 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).
Potential Impact
Successful exploitation allows an attacker to hijack a user's session and perform actions with the user's privileges. Exploitation requires capturing a valid SAML assertion and replaying it within a specific time window. The vulnerability affects only the IdP-Initiated broker flow in Keycloak. There is no impact on availability. The attack complexity is high and user interaction is required.
Mitigation Recommendations
According to the Red Hat advisory, no mitigation is currently available that meets criteria for ease of use, applicability, or stability. Users should monitor vendor advisories for future patches or fixes. Until a fix is released, organizations should be aware of the risk associated with the IdP-Initiated SAML broker flow and consider limiting its use or implementing compensating controls where possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fghp-hcwh-75j2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18967"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a74cfa5bf8831d5391b11e2
Added to database: 08/06/2026, 18:17:09 UTC
Last enriched: 08/06/2026, 19:16:05 UTC
Last updated: 08/07/2026, 03:40:59 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.