Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods
GHSA-63v5-26vq-m4vm · CVE-2026-1190
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-1190
- WEB https://github.com/keycloak/keycloak/issues/45646
- WEB https://access.redhat.com/errata/RHSA-2026:3947
- WEB https://access.redhat.com/errata/RHSA-2026:3948
- WEB https://access.redhat.com/security/cve/CVE-2026-1190
- WEB https://bugzilla.redhat.com/show_bug.cgi?id=2430835
- WEB https://github.com/keycloak/keycloak
Ready to move
Start Securing
Free, no credit card | First findings in minutes