GHSA-63v5-26vq-m4vm (CVE-2026-1190)

Details

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

Affected Packages

org.keycloak:keycloak-services

Maven

References

WEB

https://access.redhat.com/security/cve/CVE-2026-1190

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2430835

ADVISORY

https://github.com/advisories/GHSA-63v5-26vq-m4vm

WEB

https://github.com/keycloak/keycloak

WEB

https://github.com/keycloak/keycloak/issues/45646

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2026-1190