CVE-2026-18967Keycloak SAML broker assertion replay, session hijack
What broke
The SAML broker in Keycloak did not reject a replayed assertion tightly enough. An attacker who captured a valid SAML response could replay it and hijack or mint a session. High. Public around August 2026 with other Keycloak 26.7.x security fixes. Pair with CVE-2026-2603 (disabled IdP still authenticates).
Why it matters
SAML assertions are bearer tokens unless the SP enforces NotOnOrAfter, one-time InResponseTo, and a replay cache. A broker that skips that is session hijacking with an XML envelope. Keycloak is the on-prem IdP for a lot of Kubernetes estates. This is every federated app.
What to do
- Upgrade to the Keycloak build that names CVE-2026-18967 (26.7.1+ per the August 2026 notes).
- Confirm the broker rejects a replayed assertion in a staging test.
- Shorten assertion lifetimes at the partner IdP. A 10-minute
NotOnOrAfterplus a replay cache is the minimum.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
- NVD: CVE-2026-18967
- Keycloak 26.7.1 security fixes, August 2026
Related identity CVEs
Related on Start with Identity
- CVEKeycloak SAML POST-binding XSS via ACS URL
The SAML POST-binding flow reflected a crafted Assertion Consumer Service URL as script. An XSS on the IdP login path is session theft. Patched with the April 2
- CVEKeycloak SAML signature validation bypass
Keycloak's XMLSignatureUtil decided a SAML response was signed when it was not bound to the assertion later consumed. Impersonation and privilege escalation on
- CVEKeycloak session hijack via prompt=login re-authentication
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Pa
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
Technique
This CVE is an instance of Token replay against an unbound endpoint. A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.