CVE-2026-18967 Overview
CVE-2026-18967 affects the Security Assertion Markup Language (SAML) broker component of Keycloak, an open-source identity and access management (IAM) solution. When Keycloak operates as a SAML broker using the Identity Provider (IdP) Initiated flow, it fails to enforce the OneTimeUse condition contained in SAML assertions. An attacker who captures a valid, unused assertion can replay it multiple times against the broker. Successful exploitation allows session hijacking and unauthorized access as the impersonated user. The weakness is classified under CWE-294: Authentication Bypass by Capture-Replay.
Critical Impact
Attackers who capture a single valid SAML assertion can replay it to hijack user sessions and access protected applications federated through Keycloak.
Affected Products
- Keycloak SAML broker configured with the IdP-Initiated flow
- Red Hat build of Keycloak (see Red Hat CVE-2026-18967 Advisory)
- Downstream products embedding vulnerable Keycloak SAML broker functionality
Discovery Timeline
- 2026-08-06 - CVE CVE-2026-18967 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18967
Vulnerability Analysis
The SAML 2.0 specification defines the <OneTimeUse> condition inside the <Conditions> element of an assertion. Relying parties that honor this condition must reject any repeated presentation of the same assertion. Keycloak, when acting as a SAML broker through the IdP-Initiated single sign-on flow, does not enforce this constraint. As a result, the broker accepts the same assertion for authentication on subsequent requests as long as other conditions such as NotOnOrAfter remain valid. An attacker positioned on the same network segment or with prior access to a captured assertion can reuse it to authenticate as the original subject.
Root Cause
The root cause is missing validation logic for the OneTimeUse condition inside the SAML assertion parser used by the broker path. The broker does not maintain state that binds an assertion identifier to a single successful authentication, so no replay-protection cache rejects the second use. This is a classic capture-replay authentication weakness described by [CWE-294].
Attack Vector
Exploitation requires the attacker to obtain a valid SAML assertion. Common capture vectors include compromised transport channels, browser extensions with access to POST bodies, malicious relay proxies, and misconfigured logging systems that record assertion payloads. Once obtained, the attacker resubmits the assertion to the Keycloak IdP-Initiated endpoint. Because Keycloak does not track assertion consumption, the broker issues a new authenticated session tied to the victim's identity. User interaction is required to trigger the initial authentication that produces the captured assertion, and the attack path is limited to adjacent-network conditions where interception is feasible.
No verified public exploit code is available. See the Red Hat advisory
linked in the references for technical details on the vulnerable flow.
Detection Methods for CVE-2026-18967
Indicators of Compromise
- Multiple successful Keycloak broker logins that reference the same SAML assertion ID attribute within the assertion validity window.
- Repeated POST requests to the Keycloak SAML broker endpoint carrying identical SAMLResponse payloads from differing source addresses or user agents.
- Session creation events for a single subject from geographically or network-topologically inconsistent origins within a short interval.
Detection Strategies
- Enable Keycloak event logging at the IDENTITY_PROVIDER_LOGIN level and correlate the assertion_id across authentication events to identify duplicates.
- Deploy a Security Information and Event Management (SIEM) correlation rule that flags reuse of any SAML assertion identifier previously observed in a successful login.
- Inspect reverse proxy or load-balancer access logs for repeated SAMLResponse bodies hashed at ingress.
Monitoring Recommendations
- Monitor authentication anomaly metrics such as concurrent sessions per user and impossible-travel indicators for federated identities.
- Alert on any Keycloak broker error rate change following patch deployment to validate that legitimate flows continue to function.
- Track outbound requests from browser sessions to non-approved SAML endpoints that could indicate assertion exfiltration.
How to Mitigate CVE-2026-18967
Immediate Actions Required
- Apply the Keycloak security update referenced in the Red Hat CVE-2026-18967 Advisory once available for your distribution.
- Audit Keycloak realms that use SAML broker configurations and identify any relying on the IdP-Initiated flow.
- Rotate active sessions and force re-authentication for users federated through affected brokers.
Patch Information
Red Hat tracks remediation in Bug Report #2511604. Consult the vendor advisory for the fixed Keycloak and Red Hat build of Keycloak versions that add enforcement of the SAML OneTimeUse condition and introduce server-side tracking of consumed assertion identifiers.
Workarounds
- Disable the IdP-Initiated SAML flow in affected realms and require SP-Initiated authentication where possible.
- Reduce the SAML assertion lifetime by lowering NotOnOrAfter window on the issuing IdP to shrink the replay opportunity.
- Enforce mutual Transport Layer Security (TLS) and restrict broker endpoints to trusted network segments to reduce assertion capture risk.
# Example: reduce assertion validity window on the issuing IdP
# (Keycloak realm SAML settings - adjust to your environment)
kcadm.sh update realms/<realm> -s 'attributes."saml.assertion.lifespan"=60'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
