PT-2026-4811 · Red Hat · Keycloak

Osidb Bzimport · CVE-2026-1190 · Published 2026-01-26 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak’s SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it does not validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption. The vulnerability concerns the validation of timestamps in SAML responses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Insufficient Session Expiration

Weakness Enumeration

CWE-347

CWE-112

CWE-613

Related Identifiers

CVE-2026-1190

GHSA-63V5-26VQ-M4VM

Affected Products

Keycloak

References · 11

• https://access.redhat.com/errata/RHSA-2026:3948 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:3947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1190 · Security Note
• https://osv.dev/vulnerability/GHSA-63v5-26vq-m4vm · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/45646 · Note
• https://twitter.com/VulmonFeeds/status/2015913211464237263 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-1190 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2430835 · Note
• https://t.me/cveNotify/154417 · Telegram Post
• https://twitter.com/CVEnew/status/2015876118516035703 · Twitter Post