[keycloak-user] CVE-2018-14637 temporary mitigation with compensating controls?

This https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2018-14637&... tor=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H says that a SAML response from an external IdP can be replayed, because the expirations of the assertions are not checked (fixed in 4.6.0). The questions I have are about temporary mitigation before deploying version 4.6.0+. 1) Doesn't Keycloak enforce a one-time use restriction, so that no SAML response from an IdP could be reused? 2) If you have "last mile" TLS, so that the SAML responses are never transmitted in the clear, wouldn't that preclude an attacker from capturing a response in order to replay it? 3) Are there any other configurations or controls useful in temporary mitigation (e.g., IP whitelisting, so that SAML responses can only get in from the IdP's CIDR ranges)? Thanks! Regards, Peter