CVE-2026-1190

LOW3.1EPSS 0.02%

Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

發布日:2026/1/26修改日:2026/3/6

描述

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1LOW3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

參考連結(7)