CVE-2026-18967 is a vulnerability in the SAML broker component of Red Hat Build of Keycloak. When configured as a SAML broker using the IdP-Initiated flow, Keycloak does not enforce the OneTimeUse condition on SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times, potentially hijacking a user's session and gaining unauthorized access. The root cause is the failure to record and check SAML assertion IDs to enforce the OneTimeUse condition. The vulnerability requires capturing a valid assertion and replaying it within a specific time window. Red Hat rates this vulnerability as Moderate and assigns a CVSS v3.1 score of 6.4 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).

Successful exploitation allows an attacker to hijack a user's session and perform actions with that user's privileges by replaying captured SAML assertions. The vulnerability affects only the IdP-Initiated broker flow and requires the attacker to capture a valid assertion and replay it within a limited time window. There is no impact on availability. The confidentiality and integrity of the affected system can be compromised.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates. Until a fix is available, organizations should consider limiting exposure of the IdP-Initiated SAML broker flow or implementing compensating controls where feasible. Red Hat Product Security recommends upgrading to a fixed version once available.