CVE Alert: CVE-2026-107602 – Red Hat

A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token’s key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.

**Risk verdict:** This is a high-impact availability risk for exposed identity services; KEV, SSVC exploitation, PoC and EPSS indicators were not supplied, so current exploitation urgency cannot be confirmed.

A successful attack could make authentication unavailable, disrupting workforce access and applications that depend on single sign-on. Attackers could use repeated disruption to interrupt operations or create cover for activity elsewhere; the stated impact is availability rather than data theft or account modification.

Most likely attack path

An attacker can send requests over the network without credentials or user interaction, and the low-complexity preconditions make public-facing instances the main concern. The scope is unchanged, so impact appears confined to the affected identity service, although dependent applications may suffer cascading access outages.

Prioritise internet-accessible identity and access management deployments, especially where SAML 1.1 is enabled or accepted. Internal instances remain at risk if reachable from untrusted or compromised network segments.

Alert on sustained CPU saturation in identity-service processes.

Correlate spikes with inbound SAML requests and repeated parsing failures.

Monitor authentication latency, health-check failures and unexpected service restarts.

Track request bursts by source and destination endpoint.

Mitigation and prioritisation

Apply the vendor’s fixed update as soon as available; no suitable workaround is reported.

Restrict network access to identity endpoints and disable SAML 1.1 where operationally safe.

Coordinate changes with application owners; validate SSO flows and maintain a recovery plan.

Reassess urgency when exploitation-intelligence and probability data become available.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.