CVE-2026-107602 in Keycloak
Summary
by MITRE • 11/05/2026
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Keycloak stems from a critical flaw within the SAML 1.1 XML parsing logic, specifically affecting how the application processes security tokens during authentication flows. As an open-source identity and access management solution, Keycloak handles sensitive cryptographic operations and token validation for numerous enterprise environments. The core technical issue arises when the parser encounters unexpected or malformed elements within the key information section of a SAML assertion. Instead of gracefully rejecting invalid input or throwing a standard exception that halts processing, the underlying code logic enters an infinite loop. This behavior indicates a failure in boundary checking and state management during the parsing phase, where the processor fails to detect termination conditions for certain recursive or iterative operations triggered by specific XML structures.
From a security perspective, this flaw represents a classic Denial of Service vulnerability caused by improper input validation. The attacker does not need valid credentials to exploit this issue; an unauthenticated remote actor can craft and send specially formatted SAML requests that trigger the infinite loop condition. Because Keycloak typically runs on multi-threaded application servers such as WildFly or Tomcat, each incoming request is handled by a dedicated thread from the server's pool. When one of these threads becomes trapped in an infinite CPU-intensive loop due to the malformed XML payload, it consumes 100 percent of that core’s processing capacity and remains occupied indefinitely. This effectively removes that thread from the available pool, reducing the application's ability to handle legitimate traffic.
The operational impact of this vulnerability is severe for any production environment relying on Keycloak for single sign-on or identity federation services. As more threads are consumed by malicious requests targeting this flaw, the server’s resource availability degrades rapidly. Even a small number of concurrent exploitation attempts can exhaust all available worker threads, leading to a total denial of service where legitimate users cannot authenticate or access protected resources. The situation is exacerbated because standard health checks may not detect the issue immediately if they do not monitor thread states closely enough. Furthermore, resolving this state typically requires an administrator to manually restart the Keycloak server instance to clear the stuck threads and restore normal operations, resulting in significant downtime and operational disruption during incident response efforts.
This vulnerability aligns with CWE-835, which describes loops that never terminate due to a logic error, as well as CWE-400 regarding uncontrolled resource consumption. In terms of offensive security frameworks, this exploitation technique maps directly to the MITRE ATT&CK tactic of Impact under the subtechnique Denial of Service via Resource Exhaustion. To mitigate this risk, organizations should immediately apply the vendor-provided patch that addresses the XML parsing logic in Keycloak versions affected by this flaw. Additionally, implementing network-level protections such as rate limiting on authentication endpoints can help throttle malicious traffic before it reaches the application layer. Security teams should also ensure that their web servers and reverse proxies are configured to monitor for abnormal CPU usage spikes associated with specific IP ranges or request patterns indicative of XML-based attacks. Regular auditing of SAML configurations and keeping identity management software up to date is essential to maintaining robust access control infrastructure against such parsing vulnerabilities.