Start with Identity
Subscribe
Identity CVE · SAML

CVE-2026-18967Keycloak SAML broker assertion replay, session hijack

high
Product: KeycloakVendor: Red HatDisclosed: 2026-08-05Status: PatchedProtocol deep diveNVD ↗

What broke

The SAML broker in Keycloak did not reject a replayed assertion tightly enough. An attacker who captured a valid SAML response could replay it and hijack or mint a session. High. Public around August 2026 with other Keycloak 26.7.x security fixes. Pair with CVE-2026-2603 (disabled IdP still authenticates).

Why it matters

SAML assertions are bearer tokens unless the SP enforces NotOnOrAfter, one-time InResponseTo, and a replay cache. A broker that skips that is session hijacking with an XML envelope. Keycloak is the on-prem IdP for a lot of Kubernetes estates. This is every federated app.

What to do

  • Upgrade to the Keycloak build that names CVE-2026-18967 (26.7.1+ per the August 2026 notes).
  • Confirm the broker rejects a replayed assertion in a staging test.
  • Shorten assertion lifetimes at the partner IdP. A 10-minute NotOnOrAfter plus a replay cache is the minimum.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.