CVE Alert: CVE-2026-110931 – Red Hat

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.

**Risk verdict:** This is a high operational risk for exposed identity services; urgency cannot be calibrated further because KEV and SSVC exploitation status are not provided.

**Why this matters:** A remote attacker could disrupt authentication without needing an account or user action. An outage may prevent workforce and customer access to dependent applications, potentially creating a broad business interruption even without data theft or modification. The report indicates no workaround meeting the vendor’s criteria, increasing the importance of remediation.

**Most likely attack path:** An attacker sends a crafted SAML 1.1 message to a reachable service endpoint; low complexity and no privileges or user interaction are required. The impact is confined to the affected service’s security scope, so direct privilege escalation or lateral movement is not indicated, but dependent systems may become inaccessible.

**Who is most exposed:** Internet-facing identity-provider deployments and environments accepting SAML assertions from external identity providers are the priority. Internal-only instances remain at risk from reachable networks and compromised hosts.

Alert on repeated SAML parsing failures or unusually long request processing.

Monitor memory growth, JVM termination, and unexpected service restarts.

Correlate inbound SAML requests with authentication errors and availability alerts.

Preserve request metadata and service logs for incident review.

Mitigation and prioritisation:

Confirm affected deployments and apply the vendor’s fixed release as soon as available.

Restrict access to SAML endpoints to trusted networks or known identity-provider sources where feasible.

Add capacity and health monitoring as temporary resilience measures; these do not prevent exploitation.

Test authentication flows and coordinate a controlled change, including rollback planning.

Obtain KEV, SSVC, and EPSS status before final queue placement; if KEV is true or EPSS is at least 0.5, treat as priority 1.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.