CVE-2026-18967 is a medium severity (record score 6.4) flaw in the Keycloak SAML broker. In the IdP-initiated flow, Keycloak does not enforce the OneTimeUse condition, so a captured, unused assertion can be replayed and a session hijacked. We could not confirm a fixed build, so check Red Hat's advisories.
What's affected
The record lists Red Hat build of Keycloak and the JBoss Enterprise Application Platform expansion pack. The flaw applies when Keycloak acts as a SAML broker with the IdP-initiated flow.
The Red Hat CVE page we fetched does not list affected or fixed versions and links no errata, and it says its scores are preliminary. Check Red Hat's errata search and Bugzilla entry 2511604 for the fixed builds that apply to your product stream.
Scores differ by source. The record and Red Hat give 6.4 (medium), with high attack complexity and user interaction. NVD's own rating is 8.1 (high), with low complexity and no user interaction. Red Hat rates the issue Moderate. Both use an adjacent network vector and high confidentiality and integrity impact. Red Hat says no mitigation is available.
How to check if you're exposed
Find out if you use the SAML identity brokering feature with the IdP-initiated flow. In the Keycloak admin console, open each realm and look at its identity providers, then check for SAML providers that allow IdP-initiated login. If none exist, you are not exposed to this flaw.
If you use it, record the installed Keycloak or product build, which the admin console shows on the Server info page, and compare it with the builds named in Red Hat's errata.
Also look at your SAML assertions. If your identity provider sets OneTimeUse, you rely on the service provider to enforce it, which is exactly what is missing here.
What to do now
- List realms that use SAML identity brokering with IdP-initiated login.
- Look up the Red Hat errata that apply to your product stream and apply the fixed build.
- If you can, move users to SP-initiated login, which starts the flow from Keycloak.
- Keep assertion lifetimes short at the identity provider.
- Make sure SAML traffic uses TLS everywhere, since the attacker must capture an assertion.
- Review login events for repeated use of the same assertion or unexpected session starts.
Why it matters
The weakness class is CWE-294, authentication bypass by capture and replay. A SAML assertion can carry a OneTimeUse condition, which tells the receiving service to accept it once. If the receiver ignores that, anyone who captures a valid assertion before it is used can present it, and the service signs them in as the user.
The attacker needs a position to capture the assertion, which is why the vector is adjacent and the complexity is high. When the capture is possible, the impact is the full session of the user. Replay protection is a quiet control, easy to leave out, and worth testing in any SAML integration. KEV status is false.
Quick check
Which fixed version should I use?
We could not confirm one. Red Hat's CVE page lists no versions, so use the errata for your product stream.
Why do Red Hat and NVD disagree on severity?
Red Hat says 6.4 medium and NVD says 8.1 high. NVD rates the attack as easier and without user interaction.
Sources
Last reviewed: 18 October 2026.
