EUVD-2026-30883
GHSA-p5mv-gj8j-xqgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Keycloak SAML endpoint
-
DeliveryCraft malformed XML SAML payload
-
ExploitPOST request to /protocol/saml
-
ExecutionTrigger pathological XML parsing
-
PersistExhaust worker thread pool
-
ImpactIdentity provider becomes unavailable
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control granularity
|
| Exploitation Conditions | The Keycloak instance must expose its SAML endpoint (the /protocol/saml URI under a realm) to the attacker over the network, and at least one realm must have SAML enabled - which is the default for Keycloak deployments used as SAML identity providers or service providers. No authentication, no user interaction, and no special privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Limiting factors: deployments that have disabled SAML in favor of OIDC only, or that gate the SAML endpoint behind network ACLs allowing only known federation partners, are not reachable by arbitrary internet attackers; deployments behind a WAF that enforces XML structural limits may also blunt the payload before it reaches the parser. |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high-availability impact reachable over the network with low attack complexity and no privileges or user interaction - a profile consistent with trivially repeatable DoS abuse. However, no EPSS score, KEV listing, SSVC decision, or public proof-of-concept was supplied in the intelligence package, so real-world exploitation pressure cannot be quantified from the available data. Confidentiality and integrity are unaffected, so risk is bounded to availability of the IdP itself; that said, because Keycloak is typically a single point of authentication for many downstream services, a successful DoS can produce cascading outages disproportionate to the raw scope (S:U) rating. EPSS, KEV, and POC status are all missing from input - defenders should treat exploitation likelihood as unknown rather than low. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends one or more HTTP POST requests carrying a crafted SAML XML payload to a publicly reachable Keycloak SAML endpoint. The server's XML parser consumes excessive CPU processing the malformed input, and repeating the request rapidly starves the worker thread pool, causing legitimate login, token, and federation requests to time out. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile makes the attack scriptable with a simple HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads by submitting specially crafted XML payloads to the SAML endpoint. The flaw renders the identity provider unavailable, disrupting authentication for all downstream applications relying on it. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified at time of analysis in the supplied data; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7307 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2476526 for the fixed build and apply it as soon as available. Until a patch is published, compensating controls include restricting network access to the SAML endpoints (typically /realms/{realm}/protocol/saml) to known identity provider peers and service providers via a reverse proxy or WAF ACL, which reduces exposure but breaks federation with unlisted partners; deploying rate limiting on SAML POST/Redirect bindings to cap requests per source IP, which can blunt single-source flooding but is bypassed by distributed sources; placing a WAF rule that rejects abnormally large or deeply nested XML bodies before they reach Keycloak, which mitigates the parsing cost but may false-positive on legitimate complex assertions; and disabling SAML realms entirely if the deployment uses only OIDC, which eliminates the attack surface at the cost of breaking any SAML-dependent integrations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Keycloak is an open-source identity and access management solution maintained by Red Hat that implements federation protocols including SAML 2.0. The vulnerability resides in the SAML endpoint's XML input validation logic and maps to CWE-1286 (Improper Validation of Syntactic Correctness of Input), a class of bugs where malformed or pathologically structured input is accepted by a parser without enforcing structural constraints. When such input reaches the SAML processing pipeline, parsing becomes computationally expensive, monopolizing worker threads in the application server's request-handling pool until legitimate authentication requests can no longer be serviced. The affected component is identified in CPE data as cpe:2.3:a:red_hat:red_hat_build_of_keycloak across all listed versions.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
Executive ViewAI
Red Hat Keycloak instances are vulnerable to a denial-of-service attack that allows unauthenticated attackers to crash the identity provider through malicious SAML requests, rendering all dependent applications unable to authenticate users. This affects every system relying on Keycloak for access control, with no patch currently available from the vendor. Immediate mitigation is required to prevent service outage and business disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: implement WAF rules to reject malformed XML and oversized payloads targeting SAML endpoints; enable rate limiting on authentication endpoints; deploy request size limits; use load balancers with health checks to detect and isolate affected instances; segment Keycloak infrastructure to limit blast radius; monitor CPU and thread utilization for anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB