CVE Feed

    Dashboard / CVE / CVE-2026-107602

    CVE-2026-107602

    A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:7.5

    Affected Products

    Vendor
    Red Hat
    Product
    Red Hat Build Of Keycloak 26.4
    Vendor
    Redhat
    Product
    Build Keycloak
    Vendor
    Redhat
    Product
    Build Of Keycloak
    Vendor
    Redhat
    Product
    Red Hat Single Sign On
    Vendor
    Redhat
    Product
    Single Sign-on

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-92855 (CVSS 7.4) — A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication t…
    CVE-2026-114232 (CVSS 8.1) — A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection …
    CVE-2026-110932 (CVSS 7.5) — A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management sol…
    CVE-2026-110931 (CVSS 7.5) — A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management.…
    CVE-2026-103112 (CVSS 7.5) — A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The is…
    CVE-2026-117691 (CVSS 9.1) — A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the se…
    CVE-2026-118947 (CVSS 4.3) — A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides …
    CVE-2026-118959 (CVSS 5.4) — A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization…
    CVE-2026-118425 (CVSS 6.8) — A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access manage…
    CVE-2026-117627 (CVSS 5.4) — A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OID…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High