CVE-2026-18967
🔶 mediumSummary
A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user.
CVSS Score
6.4
Medium
EPSS Score
0.1
Exploit Probability
Published Date
2026-08-06
First Seen: 2026-08-07
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 39.8% of all 348,756 vulnerabilities in our database.
#209,835
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 6, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Red Hat would like to thank Lidor Vasker for reporting this issue.
SSVC data provided by
CISA
Last Modified
2026-08-10
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE IDs (Weakness Types)