PT-2026-4811 · Red Hat · Keycloak

Osidb Bzimport · Published 2026-01-26 · Updated 2026-03-05 · CVE-2026-1190

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak’s SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it does not validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption. The vulnerability concerns the validation of timestamps in SAML responses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-112

CWE-613

CWE-347

Related Identifiers

CVE-2026-1190

GHSA-63V5-26VQ-M4VM

Affected Products

Keycloak

References · 11

• https://access.redhat.com/errata/RHSA-2026:3947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1190 · Security Note
• https://access.redhat.com/errata/RHSA-2026:3948 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-63v5-26vq-m4vm · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/45646 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2430835 · Note
• https://access.redhat.com/security/cve/CVE-2026-1190 · Note
• https://twitter.com/CVEnew/status/2015876118516035703 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2015913211464237263 · Twitter Post
• https://t.me/cveNotify/154417 · Telegram Post