PT-2026-6374 · Maven · Org.Keycloak:Keycloak-Services

Published 2026-01-26 · Updated 2026-01-26

OSV

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

Fix

Improper Verification of Cryptographic Signature

Insufficient Session Expiration

Weakness Enumeration

CWE-347

CWE-112

CWE-613

Related Identifiers

GHSA-63V5-26VQ-M4VM

Affected Products

Org.Keycloak:Keycloak-Services

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1190 · Security Note
• https://osv.dev/vulnerability/GHSA-63v5-26vq-m4vm · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/45646 · Note
• https://access.redhat.com/security/cve/CVE-2026-1190 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2430835 · Note
• https://access.redhat.com/errata/RHSA-2026:3947 · Note
• https://access.redhat.com/errata/RHSA-2026:3948 · Note