No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 05 Nov 2026
- Last modified upstream: 06 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://access.redhat.com/errata/RHSA-2026:95759
- https://access.redhat.com/errata/RHSA-2026:95760
- https://access.redhat.com/errata/RHSA-2026:95761
- https://access.redhat.com/errata/RHSA-2026:95762
- https://access.redhat.com/security/cve/CVE-2026-107602
- https://bugzilla.redhat.com/show_bug.cgi?id=2547937
- Analysis, summary and remediation
- © VulnCrest