CVE-2026-18967

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

06/08/2026

Last modified:

10/08/2026

Description

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user&#39;s session and gain unauthorized access to the system as that user.

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 6.40 MEDIUM
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): None