The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2018-11-30T13:00:00

Updated: 2024-08-05T09:38:12.558Z

Reserved: 2018-07-27T00:00:00

Link: CVE-2018-14637

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-11-30T13:29:00.190

Modified: 2024-11-21T03:49:28.990

Link: CVE-2018-14637

cve-icon Redhat

Severity : Important

Publid Date: 2018-11-27T20:23:00Z

Links: CVE-2018-14637 - Bugzilla