Keycloak’s SAML brokering component does not validate the NotOnOrAfter attribute of the SubjectConfirmationData element. This omission allows an attacker to construct a SAML response that remains considered valid for longer than intended, extending session duration or forcing repeated authentication flows. The missing check can lead to unexpected resource consumption or prolonged unauthorized access if the broker accepts the stale assertion.

Affected installations include Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign‑On 7, and the Red Hat build of Keycloak version 26.4 (including 26.4.10). These are the CVE’s CNA‑identified product versions.

The CVSS score of 3.1 indicates low overall severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. This vulnerability is not listed in CISA’s known exploited vulnerabilities catalog. Attackers would need to target the SAML authentication path by injecting a crafted assertion with an inflated NotOnOrAfter timestamp; the exploitation requires access to the SAML broker configuration and the ability to supply the forged response.