Executive brief
Keycloak, a widely used identity and access management solution, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send malicious login requests that overwhelm the server's processor and exhaust its available worker threads. This can cause the authentication service to become completely unresponsive, preventing legitimate users from logging into their applications and disrupting business operations.
Technical details
A vulnerability exists in Keycloak's SAML implementation due to improper validation of syntactic correctness in XML input (CWE-1286). A remote, unauthenticated attacker can exploit this by sending a specially crafted XML payload to the Security Assertion Markup Language (SAML) endpoint. The processing of this malicious input triggers excessive CPU consumption and worker thread starvation. This leads to a Denial of Service (DoS) condition where the server is unable to process further requests. The issue is resolved in Keycloak version 26.6.2 and corresponding Red Hat build updates.
Affected products
- Keycloak Keycloak < 26.6.2
- Red Hat Red Hat build of Keycloak 26.2.x < 26.2.16, 26.4.x < 26.4.12
Timeline
- 2026-05-12: other: Initial report in Red Hat Bugzilla
- 2026-05-19: disclosed: CVE-2026-7307 published
- 2026-05-19: advisory: GitHub Advisory GHSA-p5mv-gj8j-xqgf published
- 2026-05-20: patched: Red Hat released security updates (RHSA-2026:19594, RHSA-2026:19597)