Insufficient Session Expiration in Keycloak - CVE-2026-1190
Published: September 10, 2026
Vulnerability identifier: #VU148919
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-1190
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to extend the validity period of SAML responses.
The vulnerability exists due to missing timestamp validation in Keycloak's SAML brokering functionality when processing SAML responses containing SubjectConfirmationData. A remote attacker can delay expiration of a SAML response to extend the time it is considered valid.
User interaction is required.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2026-1190
Install security update from vendor's website.
Keycloak - update to 26.5.4
Red Hat build of Keycloak - update to 26.4.10
Red Hat build of Keycloak - update to 26.4.10