CVE-2026-18967

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the SAML broker component of Keycloak when configured using the IdP-Initiated flow. The system fails to enforce the OneTimeUse condition in SAML assertions, which are XML-based tokens used to exchange authentication and authorization data. This allows an attacker who captures a valid, unused assertion to replay it multiple times, potentially hijacking a user session and gaining unauthorized access to the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.