{"id":"CVE-2026-18967","aliases":["EUVD-2026-53716","GHSA-fghp-hcwh-75j2"],"status":"published","title":"Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow","description":"A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00233,"percentile":0.1425,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-294"],"published":"2026-08-06T05:33:17Z","modified":"2026-08-10T19:15:58Z","products":[{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"redhat","product":"build_of_keycloak"},{"vendor":"redhat","product":"jboss_enterprise_application_platform_expansion_pack"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-18967","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511604","tags":["issue-tracking","x_refsource_REDHAT","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18967"},{"url":"https://github.com/advisories/GHSA-fghp-hcwh-75j2"}],"sources":{"cve":[{"id":"CVE-2026-18967","title":"Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow","description":"A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.","status":"published","published":"2026-08-06T05:33:17.868Z","modified":"2026-08-06T17:31:57.855Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-53716","description":"A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.","status":"published","published":"2026-08-06T05:33:17Z","modified":"2026-08-06T17:31:57Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-fghp-hcwh-75j2","title":"A flaw was found in the SAML broker component of Keycloak, an identity and access management...","description":"A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.","status":"published","published":"2026-08-06T09:30:30Z","modified":"2026-08-06T09:30:30Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:10:08.59251Z"}],"nvd":[{"id":"CVE-2026-18967","description":"A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.","status":"published","published":"2026-08-06T07:16:29.413Z","modified":"2026-08-10T19:15:58.587Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:12:35.031043Z"}]}}