---
id: "CVE-2026-107602"
kind: "vulnerability"
aliases: ["CVE-2026-107602"]
title: "Keycloak: crafted SAML 1.1 token makes login server spin forever"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "keycloak", "fixed": ["26.8.2", "26.6.8", "26.4.17"], "affected": "unknown lower bound, < 26.8.2 (also < 26.6.8 on 26.6, < 26.4.17 on 26.4)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["identity", "infrastructure", "keycloak", "saml", "self-hosted"]
not_affected_if: ["behind-network-filter", "saml-disabled"]
published_at: "2026-11-05T17:17:35+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:47:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107602", "first_seen_at": "2026-11-05T17:40:03+00:00"}, {"source": "analyst", "url": "https://github.com/keycloak/keycloak/issues/54692", "first_seen_at": "2026-11-05T17:47:11+00:00", "cites": ["https://github.com/keycloak/keycloak/issues/54692", "https://github.com/keycloak/keycloak/releases/"]}]
exploit_sources: []
---

# Keycloak: crafted SAML 1.1 token makes login server spin forever

Keycloak's SAML 1.1 KeyInfo parser loops forever on a legal ds:KeyName element. Keycloak's issue calls it unauthenticated CPU and worker-pool exhaustion that needs a restart. Fixed in 26.8.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:keycloak affected unknown lower bound, < 26.8.2 (also < 26.6.8 on 26.6, < 26.4.17 on 26.4) fixed 26.8.2, 26.6.8, 26.4.17

## How to check

- Run kc.sh --version (or read the startup log). Anything below 26.8.2 on the 26.8 line is exposed; on 26.6 and 26.4 the fix is labeled for 26.6.8 and 26.4.17.
- The affected range's lower bound is not stated in the sources I read; treat older releases as exposed until the advisory says otherwise.
- Check whether the SAML endpoints (e.g. /realms/{realm}/protocol/saml) are reachable from untrusted networks. Whether SAML 1.1 handling is on by default is not confirmed.

## Fix

Upgrade Keycloak to 26.8.2 (released 2026-11-05). The project's issue #54692 is also labeled for 26.6.8 and 26.4.17 backports; check those release pages before relying on them.

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107602
- 2026-11-05T17:47:11+00:00 analyst https://github.com/keycloak/keycloak/issues/54692 — Keycloak issue #54692 (primary, labels release/26.8.2, 26.6.8, 26.4.17) and 26.8.2 release notes list the fix. No exploit or PoC seen. The Miggo page is about CVE-2026-7307, a different CVE, so I did not use it. Lower bound and the SAML 1.1 default are still unknown; the issue has no body. X not checked.

## Documents

- [advisory] [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion via SAML 1.1 KeyInfo parser loop (keycloak #54692) https://github.com/keycloak/keycloak/issues/54692
- [fix] Keycloak 26.8.2 release notes https://github.com/keycloak/keycloak/releases/

## From the sources

A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_