CVE-2026-18967: redhat build_of_keycloak Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2026-18967 is a high (CVSS 8.1) Authentication Bypass by Capture-replay vulnerability in redhat build_of_keycloak. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.2% of scored vulnerabilities.

Timeline

1. 06-08-2026
   PublishedVulnerability first disclosed.
2. 06-08-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).