PT-2026-6374 · Maven · Org.Keycloak:Keycloak-Services

Publicado 2026-01-26 · Atualizado 2026-01-26

OSV

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

Correção

Improper Verification of Cryptographic Signature

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-347

CWE-112

CWE-613

Identificadores relacionados

GHSA-63V5-26VQ-M4VM

Produtos afetados

Org.Keycloak:Keycloak-Services

Referências · 8

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/issues/45646 · Nota
• https://access.redhat.com/security/cve/CVE-2026-1190 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2430835 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1190 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2026:3947 · Nota
• https://access.redhat.com/errata/RHSA-2026:3948 · Nota
• https://osv.dev/vulnerability/GHSA-63v5-26vq-m4vm · Aviso do Fabricante