CVE-2026-18967Keycloak SAML broker assertion replay, session hijack
What broke
The SAML broker in Keycloak did not reject a replayed assertion tightly enough. An attacker who captured a valid SAML response could replay it and hijack or mint a session. High. Public around August 2026 with other Keycloak 26.7.x security fixes. Pair with CVE-2026-2603 (disabled IdP still authenticates).
Why it matters
SAML assertions are bearer tokens unless the SP enforces NotOnOrAfter, one-time InResponseTo, and a replay cache. A broker that skips that is session hijacking with an XML envelope. Keycloak is the on-prem IdP for a lot of Kubernetes estates. This is every federated app.
What to do
- Upgrade to the Keycloak build that names CVE-2026-18967 (26.7.1+ per the August 2026 notes).
- Confirm the broker rejects a replayed assertion in a staging test.
- Shorten assertion lifetimes at the partner IdP. A 10-minute
NotOnOrAfterplus a replay cache is the minimum.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
- NVD: CVE-2026-18967
- Keycloak 26.7.1 security fixes, August 2026
Related identity CVEs
Related on Start with Identity
- CVEKeycloak SAML POST-binding XSS via ACS URL
The SAML POST-binding flow reflected a crafted Assertion Consumer Service URL as script. An XSS on the IdP login path is session theft. Patched with the April 2
- CVEKeycloak SAML signature validation bypass
Keycloak's XMLSignatureUtil decided a SAML response was signed when it was not bound to the assertion later consumed. Impersonation and privilege escalation on
- CVEKeycloak session hijack via prompt=login re-authentication
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Pa
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
Technique
This CVE is an instance of Token replay against an unbound endpoint. A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.