Threats Tagged 'cve-2026-18967'

A vulnerability in the SAML broker component of Keycloak allows replay of SAML assertions when using the IdP-Initiated flow. The flaw is due to failure to enforce the OneTimeUse condition, enabling attackers who capture a valid assertion to reuse it multiple times. This can lead to session hijacking and unauthorized access. The vulnerability has a moderate severity score of 6.4 and requires the attacker to capture a valid assertion and replay it within a limited time window. No official patch or mitigation is currently available from Red Hat.

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.