Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-9794

Keycloak: keycloak: information disclosure via saml ecp endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.13-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-19 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-19 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.13

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6.3-3 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-6 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-6 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6.3

Default version status: unaffected

References