Red Hat Keycloak CVE-2026-9794

The SAML ECP endpoint must be enabled and reachable by the attacker - this endpoint is a specific SAML profile feature and may not be active in all deployments, particularly those using only OIDC or standard SAML SP flows. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that beyond network reachability, no authentication, specific privileges, user interaction, or elevated complexity is required. Limiting factors include: deployments that have disabled the SAML ECP profile, network perimeter controls that restrict access to Keycloak's authentication endpoints, and environments using OIDC exclusively (no SAML configuration at all). The vulnerability does not grant code execution or credential access - it is limited to disclosing whether a given client ID maps to a SAML or non-SAML protocol type.

The CVSS base score of 5.3 (Medium) reflects a network-accessible, low-complexity, unauthenticated attack with a limited confidentiality impact (C:L) and no integrity or availability impact (I:N/A:N). The attack vector (AV:N/AC:L/PR:N/UI:N) means any instance with the SAML ECP endpoint reachable over a network is exposed without any prerequisite conditions. EPSS data was not provided in the input and cannot be inferred; this represents a gap in the risk picture. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified, which lowers urgency compared to other Medium-CVSS issues. However, the practical risk is meaningful in reconnaissance contexts: leaking client protocol mappings assists attackers in profiling the IAM environment and narrowing attack surface for follow-on campaigns. The absence of authentication requirements means automated scanning tools could enumerate this at scale. Overall, this is a real but limited-scope issue - not a priority for emergency patching, but warrants remediation within a normal patch cycle given the zero-barrier exploitation path.

An unauthenticated attacker discovers a publicly accessible Keycloak instance and submits a series of SOAP requests to the SAML ECP endpoint, cycling through candidate client IDs and recording the specific faultstring returned for each. By correlating distinct error messages to protocol types, the attacker builds a map of which client IDs correspond to SAML versus OIDC configurations, enabling more targeted follow-on attacks against specific clients or application integrations. No exploit code is publicly available, but the attack requires only standard HTTP tooling and observation of response text differences.