CVE-2026-1190: Keycloak SAML Auth Bypass Vulnerability

CVE-2026-1190 Overview

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

Critical Impact

Improper validation of the NotOnOrAfter timestamp in SAML SubjectConfirmationData can allow attackers to extend SAML response validity periods, leading to prolonged unauthorized sessions and potential resource consumption.

Affected Products

• Keycloak (when configured as a SAML client/broker)

Discovery Timeline

• 2026-01-26 - CVE-2026-1190 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2026-1190

Vulnerability Analysis

This vulnerability falls under CWE-112: Missing XML Validation, which occurs when an application fails to properly validate XML input against required security constraints. In this specific case, Keycloak's SAML brokering functionality does not properly validate the NotOnOrAfter timestamp contained within the SubjectConfirmationData element of SAML assertions.

The SAML 2.0 specification requires that identity providers include time-based constraints in assertions to limit their validity window. The NotOnOrAfter attribute specifies the moment after which the subject confirmation is no longer valid. When this timestamp is not validated by the receiving service provider (in this case, Keycloak acting as a SAML client), attackers can potentially replay or extend the validity of captured SAML responses beyond their intended expiration.

The attack requires network access and user interaction, making exploitation more complex. However, successful exploitation could result in integrity impacts where sessions remain valid longer than intended by the identity provider's security policy.

Root Cause

The root cause is improper XML validation in Keycloak's SAML assertion processing logic. Specifically, when Keycloak operates as a SAML service provider or broker, it fails to check whether the current time exceeds the NotOnOrAfter value specified in the SubjectConfirmationData element. This missing validation check allows SAML assertions to be accepted even after they should have expired according to the issuing identity provider's policies.

Attack Vector

The attack vector is network-based and requires the following conditions:

1. Keycloak must be configured as a SAML client or broker
2. An attacker must intercept or obtain a valid SAML response
3. The attacker can then replay or use the SAML response after its intended expiration time
4. This requires user interaction as the attacker needs access to a legitimate SAML assertion

The vulnerability enables an attacker to extend session validity beyond the security boundaries established by the identity provider. While the direct impact is limited to integrity concerns (unauthorized session extension), it could contribute to broader attack chains where persistent access is valuable.

For detailed technical information about this vulnerability, refer to the Red Hat CVE-2026-1190 Advisory and Red Hat Bug Report #2430835.

Detection Methods for CVE-2026-1190

Indicators of Compromise

• SAML authentication events occurring with assertions that have NotOnOrAfter timestamps significantly in the past
• Session activity continuing beyond expected identity provider session timeout periods
• Unusual patterns of SAML assertion reuse or replay attempts in authentication logs
• Discrepancies between identity provider session logs and Keycloak session durations

Detection Strategies

• Implement SAML assertion monitoring to compare assertion timestamps against system clock
• Enable detailed SAML debugging in Keycloak to log SubjectConfirmationData elements including timestamp values
• Deploy network-level monitoring to detect potential SAML assertion replay attempts
• Configure SIEM rules to alert on authentication events with expired assertion timestamps

Monitoring Recommendations

• Monitor Keycloak authentication logs for SAML brokering events with unusual timing patterns
• Implement correlation rules between identity provider logs and Keycloak session logs to detect timestamp mismatches
• Set up alerts for sessions that exceed expected duration limits based on identity provider policies
• Review SAML configuration periodically to ensure all timestamp validation settings are properly configured

How to Mitigate CVE-2026-1190

Immediate Actions Required

• Review your Keycloak deployment to determine if SAML brokering functionality is in use
• Monitor the Red Hat CVE-2026-1190 Advisory for patch availability and updates
• Implement additional session timeout controls at the application level as a defense-in-depth measure
• Consider implementing network-level controls to limit SAML assertion lifetime at the infrastructure level

Patch Information

At the time of publication, organizations should monitor Red Hat's security advisories for official patches addressing this vulnerability. Check the Red Hat Bug Report #2430835 for the latest status on fixes and affected versions.

When a patch becomes available, test it in a non-production environment before deploying to production Keycloak instances. Ensure all Keycloak nodes in a cluster are updated consistently.

Workarounds

• Implement strict session timeout policies within Keycloak that are shorter than or equal to the identity provider's SAML assertion validity period
• Configure additional authentication requirements for sensitive operations to limit the impact of extended sessions
• Deploy a Web Application Firewall (WAF) with SAML inspection capabilities to enforce timestamp validation at the network perimeter
• Consider implementing SAML assertion one-time-use enforcement using a token replay cache

# Review Keycloak SAML configuration
# Check your standalone.xml or standalone-ha.xml for SAML settings
grep -r "saml" /opt/keycloak/standalone/configuration/

# Monitor authentication logs for SAML events
tail -f /opt/keycloak/standalone/log/server.log | grep -i "saml"