# CVE-2026-107123: Keycloak SAML XML denial of service via unvalidated dateTime parsing

Source: https://junglewise.ai/threats/cve-2026-107123-a-flaw-was-found-in-the-saml-xml-processing-component-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-107123 · Severity: high · CVSS 7.5 · Published 2026-11-05

Keycloak is an identity and access management platform that organizations use to authenticate users and control access to applications. This vulnerability allows an unauthenticated attacker to send specially crafted SAML authentication requests that cause excessive CPU consumption, making the authentication service unavailable to all users. An exploit could disrupt login services across an entire organization.

Technologies: [Red Hat Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-107123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107123 being exploited in the wild.

**How severe is CVE-2026-107123?** High severity, with a CVSS score of 7.5, published 5 November 2026.

**Which products and versions are affected?** Red Hat Keycloak.

**Is there a fix for CVE-2026-107123?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107123 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-107123?** Check whether you run Red Hat Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in the SAML XML processing component. The server fails to validate the length of dateTime and duration string values before parsing them, allowing an attacker to send XML documents with excessively long values that exhaust CPU resources. An unauthenticated attacker on the network can trigger this denial of service without authentication or user interaction required.

## Affected products

- Red Hat Keycloak

## Timeline

- 2026-11-05: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-107123](https://access.redhat.com/security/cve/CVE-2026-107123)

## Related threats

- [Red Hat Keycloak missing authorization check in group reparenting](https://junglewise.ai/threats/cve-2026-116468-a-flaw-was-found-in-the-group-move-and-organization-group)
- [Keycloak privilege escalation via client authentication manipulation](https://junglewise.ai/threats/cve-2026-9797-a-flaw-was-found-in-keycloak-s-administrative-services-org)
- [Keycloak Account REST API session manipulation](https://junglewise.ai/threats/cve-2026-97367-a-flaw-was-found-in-the-keycloak-account-rest-api-where-it)
- [Keycloak token exchange lifetime bypass in Standard Token Exchange V2](https://junglewise.ai/threats/cve-2026-96460-a-flaw-was-found-in-the-token-exchange-mechanism-of-keycloak-when)
- [Keycloak SAML broker ProxyRestriction bypass](https://junglewise.ai/threats/cve-2026-92856-a-flaw-was-found-in-the-saml-brokering-component-of-keycloak-an)