CVE-2026-18967

Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

Published Aug 6, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.

Analysis

Technical impact

This vulnerability arises from a missing enforcement of the OneTimeUse condition in SAML assertions during IdP‑initiated broker flows within Keycloak. Because an attacker can capture a still‑unused assertion, the flaw allows replaying that assertion multiple times, effectively hijacking a legitimate user’s session and gaining unauthorized access.

Affected Systems

Affected products include Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. No specific affected versions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 6.4 signals moderate severity. No EPSS score is available, so the exploitation probability is unknown; the issue is not reported in CISA’s KEV catalog. Inferred from the description, the attack vector is likely remote via intercepted SAML assertions, requiring an attacker to obtain a valid yet unused assertion before replaying it. Successful exploitation would grant an attacker the privileges of the impersonated user.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	Red Hat Build of Keycloak	affected	—
Red Hat	Red Hat Build of Keycloak	affected	—
Red Hat	Red Hat Build of Keycloak	affected	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	affected	—
Red Hat	Red Hat Single Sign-On 7	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:redhat:build_of_keycloak:-::::-:::
	cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:::::::*

No data.

Vendor Product Versions

Redhat

Build Of Keycloak

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Jboss Enterprise Application Platform Expansion Pack

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Single Sign-on

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

Upgrade to the latest Red Hat Build of Keycloak or apply a vendor patch that enforces the OneTimeUse condition in SAML assertions.
If an upgrade is not possible, disable IdP‑initiated broker flows or reconfigure the broker to reject any assertion that does not explicitly contain the OneTimeUse condition.
Implement monitoring or logging to detect repeated use of the same SAML assertion, and investigate any such events promptly.

Generated by OpenCVE AI on August 6, 2026 at 07:29 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.233% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-18967
https://bugzilla.redhat.com/show_bug.cgi?id=2511604
https://nvd.nist.gov/vuln/detail/CVE-2026-18967
https://www.cve.org/CVERecord?id=CVE-2026-18967

History

Aug 7, 2026 9:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat build Of Keycloak Redhat jboss Enterprise Application Platform Expansion Pack Redhat single Sign-on
Vendors & Products		Redhat build Of Keycloak Redhat jboss Enterprise Application Platform Expansion Pack Redhat single Sign-on

Aug 6, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 6, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-18967 https://www.cve.org/CVERecord?id=CVE-2026-18967
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 6, 2026 6:30 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.
Title		Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow
First Time appeared		Redhat Redhat build Keycloak Redhat jbosseapxp Redhat red Hat Single Sign On
Weaknesses		CWE-294
CPEs		cpe:/a:redhat:build_keycloak: cpe:/a:redhat:jbosseapxp cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products		Redhat Redhat build Keycloak Redhat jbosseapxp Redhat red Hat Single Sign On
References		https://access.redhat.com/security/cve/CVE-2026-18967 https://bugzilla.redhat.com/show_bug.cgi?id=2511604
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}`