CVE-2026-1190: 
Java vulnerability analysis and mitigation

CVE-2026-1190 is a missing XML validation flaw in Keycloak's SAML brokering functionality, specifically affecting the org.keycloak/keycloak-services component. When Keycloak is configured as a SAML client (SAML brokering), it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData element of SAML responses, allowing an attacker to delay a SAML response beyond its intended validity window. This can result in unexpected session durations or resource consumption. The vulnerability was reported on January 19, 2026, and published by Red Hat on January 26, 2026, with patches released on March 5, 2026. It carries a CVSS v3.1 base score of 3.1 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-112 (Missing XML Validation): Keycloak's SAML brokering code checks the NotOnOrAfter timestamp in the SAML Conditions element but omits the equivalent check in SubjectConfirmationData. An attacker who can intercept or delay a legitimate SAML response in transit can present it to Keycloak after the SubjectConfirmationData expiry time has passed, and Keycloak will still accept it as valid. Exploitation requires network access, high attack complexity, and user interaction (a legitimate user must initiate the SAML flow), and the SAML response cannot be tampered with because signature validation would fail — the attacker can only delay delivery of an already-signed response (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation has a limited integrity impact: an attacker can extend the effective validity window of a SAML response, potentially causing Keycloak to establish a session that should have been rejected due to expiry. There is no confidentiality or availability impact assessed. The practical consequence is unexpected or prolonged session durations and potential resource consumption on the Keycloak server, but the attacker cannot forge, replay to a different request, or otherwise tamper with the SAML assertion due to signature enforcement (Red Hat Bugzilla, Red Hat CVE).

1. Identify target: Locate a Keycloak instance configured in SAML brokering mode (acting as a SAML service provider/client) on an unpatched version prior to 26.4.10 or 26.5.4.
2. Initiate legitimate SAML flow: Trigger or wait for a legitimate user to initiate a SAML authentication flow, causing the Identity Provider (IdP) to issue a signed SAML response.
3. Intercept and delay: Using a network-level man-in-the-middle position or by controlling a network segment between the IdP and the user's browser, intercept the SAML response (typically a POST binding) and delay its forwarding to Keycloak beyond the NotOnOrAfter time specified in SubjectConfirmationData.
4. Forward delayed response: Submit the delayed but otherwise unmodified SAML response to Keycloak's SAML assertion consumer endpoint. Because Keycloak does not validate the SubjectConfirmationData.NotOnOrAfter field, it accepts the expired response.
5. Session established: Keycloak creates a user session based on the delayed response, potentially granting access beyond the intended validity window (Red Hat Bugzilla).

• Logs: Keycloak server logs showing SAML assertion consumer service (ACS) requests where the timestamp of the request significantly lags behind the NotOnOrAfter value in SubjectConfirmationData; look for successful authentications via SAML brokering at unexpected times.
• Network: Unusual delays between IdP-issued SAML responses and their submission to the Keycloak ACS endpoint; HTTP POST requests to Keycloak's SAML ACS URL (e.g., /realms/<realm>/broker/<idp>/endpoint) arriving well after the expected SAML response window.
• Session anomalies: User sessions in Keycloak that were established at times inconsistent with normal authentication patterns, particularly sessions created outside business hours or after unusually long delays following IdP authentication events.

Red Hat released patches addressing CVE-2026-1190 in Red Hat build of Keycloak 26.4.10 (RHSA-2026:3947 for packages, RHSA-2026:3948 for OpenShift container images), issued on March 5, 2026. The upstream Keycloak project also addressed this in the Keycloak 26.5.4 release. Administrators should upgrade to these versions or later as the primary remediation. No specific configuration-based workaround has been published; however, ensuring SAML responses are signed (which prevents tampering) limits the practical impact while patching is pending (Red Hat Advisory RHSA-2026:3947, Red Hat Advisory RHSA-2026:3948, Keycloak Releases).

The vulnerability received routine coverage from vulnerability aggregation platforms and security databases upon publication. Red Hat classified the broader advisory (RHSA-2026:3947) containing this CVE as "Important" severity due to the combination of multiple SAML-related flaws addressed together, though CVE-2026-1190 itself is rated Low individually. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified (Red Hat Advisory RHSA-2026:3947).