CVE-2026-1190

Description

A flaw was found in Keycloaks SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

Risk Information

Base Score

3.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS Score

Exploitation Probability

0.016

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-1190 are affected in Keycloak-services 26.5.2	Windows
Vulnerabilities CVE-2026-1190 are affected in Keycloak-services for Linux 26.5.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234