{"id":"CVE-2026-107602","kind":"vulnerability","aliases":["CVE-2026-107602"],"related":[],"title":"Keycloak: crafted SAML 1.1 token makes login server spin forever","description":"A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.","summary":"Keycloak's SAML 1.1 KeyInfo parser loops forever on a legal ds:KeyName element. Keycloak's issue calls it unauthenticated CPU and worker-pool exhaustion that needs a restart. Fixed in 26.8.2.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak","fixed":["26.8.2","26.6.8","26.4.17"],"affected":"unknown lower bound, < 26.8.2 (also < 26.6.8 on 26.6, < 26.4.17 on 26.4)","ecosystem":"vendor"}],"ecosystems":[],"tags":["identity","infrastructure","keycloak","saml","self-hosted"],"not_affected_if":["behind-network-filter","saml-disabled"],"how_to_check":"- Run kc.sh --version (or read the startup log). Anything below 26.8.2 on the 26.8 line is exposed; on 26.6 and 26.4 the fix is labeled for 26.6.8 and 26.4.17.\n- The affected range's lower bound is not stated in the sources I read; treat older releases as exposed until the advisory says otherwise.\n- Check whether the SAML endpoints (e.g. /realms/{realm}/protocol/saml) are reachable from untrusted networks. Whether SAML 1.1 handling is on by default is not confirmed.","fix":"Upgrade Keycloak to 26.8.2 (released 2026-11-05). The project's issue #54692 is also labeled for 26.6.8 and 26.4.17 backports; check those release pages before relying on them.","status":"open","published_at":"2026-11-05T17:17:35+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:27+00:00","updated_at":"2026-11-05T17:47:11+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T17:42:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: crafted SAML 1.1 token makes login server spin forever","impact":"high","summary":"Keycloak's SAML 1.1 parser enters an infinite loop when a security token's key information section contains unexpected elements. An unauthenticated remote attacker can send crafted requests to pin CPU at 100% and take the service down until it is restarted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","self-hosted","saml","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Keycloak service halts at full CPU until a server restart","analyst_note":"Find the affected and fixed Keycloak version ranges and whether SAML 1.1 is enabled by default, from the NVD entry or the Keycloak project advisory.","how_to_check":"- Check the Keycloak version with `kc.sh --version` or the server startup log\n- Check whether SAML identity brokering or SAML 1.1 endpoints are enabled in the realm settings\n- unknown for the exact affected version range, as the sources do not list it","plain_action":"","needs_analyst":true,"not_affected_if":["saml-disabled","behind-network-filter"],"who_is_affected":"Teams that run Keycloak as their identity and access management service and accept SAML 1.1 requests from the internet are exposed, since the flaw is reached before any login. Deployments that do not expose SAML endpoints, or that sit behind access controls that block them, are less exposed. The sources do not give the affected version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":4273,"output_tokens":590,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Keycloak version ranges and whether SAML 1.1 is enabled by default, from the NVD entry or the Keycloak project advisory.","search":"'-107602':13A,16A '-2026':12A,15A '1.1':4A,28B,65C '100':120C '26.8.2':57B 'access':77C 'attack':109C 'call':42B 'caus':97C 'could':110C 'cpu':45B,121C 'craft':2A,116C 'cve':11A,14A 'denial':126C 'ds':36B 'element':38B,88C 'encount':86C 'enter':102C 'exhaust':50B 'exploit':111C 'fix':55B 'flaw':59C 'forev':10A,32B 'found':61C 'host':24B 'ident':18B,75C 'infinit':104C 'inform':95C 'infrastructur':19B 'issu':41B,81C 'key':94C 'keycloak':1A,17A,20B,25B,39B,70C 'keyinfo':29B 'keynam':37B 'lead':118C 'legal':35B 'logic':68C 'login':7A 'loop':31B,105C 'make':6A 'manag':78C 'need':52B 'occur':82C 'open':73C 'open-sourc':72C 'pars':67C 'parser':30B,85C 'pool':49B 'process':99C 'remot':108C 'request':117C 'requir':130C 'resolv':135C 'restart':54B,133C 'saml':3A,21B,27B,64C 'section':96C 'secur':91C 'self':23B 'self-host':22B 'send':114C 'server':8A,132C 'servic':128C 'solut':79C 'sourc':74C 'special':115C 'spin':9A 'thread':100C 'token':5A,92C 'total':125C 'unauthent':44B,107C 'unexpect':87C 'usag':122C 'within':89C 'worker':48B 'worker-pool':47B 'xml':66C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Keycloak as their identity and access management service and accept SAML 1.1 requests from the internet are exposed, since the flaw is reached before any login. Deployments that do not expose SAML endpoints, or that sit behind access controls that block them, are less exposed. The sources do not give the affected version range.","tier":"B","verified":{"fix":{"at":"2026-11-05T17:47:11Z","by":"analyst","doc":"https://github.com/keycloak/keycloak/releases/","run_id":1808}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["keycloak"],"ptokens":["keycloak"],"labels":["high","identity","infrastructure","keycloak","saml","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T17:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107602","severity":null,"published_at":"2026-11-05T17:17:35+00:00","modified_at":"2026-11-05T17:17:35+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107602:1808","url":"https://github.com/keycloak/keycloak/issues/54692","severity":null,"published_at":"2026-11-05T17:47:11+00:00","modified_at":"2026-11-05T17:47:11+00:00","first_seen_at":"2026-11-05T17:47:11+00:00","fetched_at":"2026-11-05T17:47:11+00:00","note":"Keycloak issue #54692 (primary, labels release/26.8.2, 26.6.8, 26.4.17) and 26.8.2 release notes list the fix. No exploit or PoC seen. The Miggo page is about CVE-2026-7307, a different CVE, so I did not use it. Lower bound and the SAML 1.1 default are still unknown; the issue has no body. X not checked.","cites":["https://github.com/keycloak/keycloak/issues/54692","https://github.com/keycloak/keycloak/releases/"]}],"documents":[{"id":78380,"url":"https://github.com/keycloak/keycloak/issues/54692","title":"[CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion via SAML 1.1 KeyInfo parser loop (keycloak #54692)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78381,"url":"https://github.com/keycloak/keycloak/releases/","title":"Keycloak 26.8.2 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}