CVE-2026-86756

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint SamlController::acs, POST /saml/acs. The endpoint wrote the RelayState POST parameter directly into Laravel's url.intended session key with only CR/LF characters stripped, and...

Red Hat keycloak denial of service vulnerability

Red Hat keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in the SAML broker consumer endpoint in versions prior to Red Hat keycloak 4.6.0.Final, which stems from a...

CVE-2018-14637: Improper Authentication

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

PT-2018-12632

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 4.6.0.Final Description The issue concerns the SAML broker consumer endpoint in Keycloak, which ignores expiration conditions on SAML assertions. This can be exploited by an attacker to perform a replay attack...