CVE-2026-18967 is an authentication bypass vulnerability in the SAML broker component of Red Hat Build of Keycloak. When configured as a SAML broker using the IdP-Initiated flow, Keycloak does not enforce the OneTimeUse condition on SAML assertions, allowing attackers who capture a valid, unused assertion to replay it multiple times. This flaw enables attackers to hijack user sessions and gain unauthorized access with the user's privileges. The root cause is the failure to record and check assertion IDs to enforce one-time use. The vulnerability is rated medium severity (CVSS 6.4) and requires user interaction and adjacent network access for exploitation. Red Hat has not provided an official fix or effective mitigation at this time.

Successful exploitation allows an attacker to hijack a user's session and perform actions with that user's privileges by replaying captured SAML assertions multiple times. This compromises confidentiality and integrity of the affected system. The attack requires capturing a valid assertion and replaying it within a specific time window. The vulnerability affects only the IdP-Initiated broker flow in Keycloak. There is no impact on availability.

Currently, no official fix or mitigation meeting Red Hat's criteria for ease of use, deployment, and applicability is available. Users should monitor Red Hat advisories for updates. Since exploitation requires capturing a valid SAML assertion and replaying it within a limited time window, organizations should consider additional compensating controls around network security and assertion handling where feasible. Red Hat Product Security recommends upgrading to a fixed version once available.