Start with Identity
Identity CVE · SAML

CVE-2026-18967Keycloak SAML broker assertion replay, session hijack

high
Product: KeycloakVendor: Red HatDisclosed: 2026-08-05Status: PatchedProtocol deep diveNVD ↗

What broke

The SAML broker in Keycloak did not reject a replayed assertion tightly enough. An attacker who captured a valid SAML response could replay it and hijack or mint a session. High. Public around August 2026 with other Keycloak 26.7.x security fixes. Pair with CVE-2026-2603 (disabled IdP still authenticates).

Why it matters

SAML assertions are bearer tokens unless the SP enforces NotOnOrAfter, one-time InResponseTo, and a replay cache. A broker that skips that is session hijacking with an XML envelope. Keycloak is the on-prem IdP for a lot of Kubernetes estates. This is every federated app.

What to do

  • Upgrade to the Keycloak build that names CVE-2026-18967 (26.7.1+ per the August 2026 notes).
  • Confirm the broker rejects a replayed assertion in a staging test.
  • Shorten assertion lifetimes at the partner IdP. A 10-minute NotOnOrAfter plus a replay cache is the minimum.

After you patch

A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.

  • Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
  • Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
  • Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
  • Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.

Sources

Last reviewed By SWI Community TeamSuggest a correctionHow we research

Technique

This CVE is an instance of Token replay against an unbound endpoint. A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.

Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.