KEYCLOAK · CVE-2026-110931 · Runtime
FIX → 26.4.17 · 26.6.8 · 26.8.2 ✓ verified
A crafted SAML 1.1 AuthorityBinding element sends Keycloak's parser into a loop. Keycloak's issue describes this as an unauthenticated single-request JVM termination (OutOfMemoryError), and says the fix for CVE-2026-7307 was incomplete. Fixed in 26.4.17, 26.6.8 and 26.8.2.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Keycloak deployments that accept SAML 1.1 assertions are the exposed ones, since the flaw sits in that parser. The sources do not state the exact version range or whether SAML 1.1 is on by default, so the scope cannot be confirmed from them. Teams using Keycloak only with OIDC or SAML 2.0 may be able to skip it once confirmed.
Not affected if oidc-only, saml-1.1-disabled
Who cares identity, keycloak, saml, self-hosted
s version command or check the admin consoles server info26.4.17, 26.6.8 or 26.8.2 on the matching line are not fixed26.6.2 were already exposed to the earlier CVE-2026-7307A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 26.4.17 · 26.6.8 · 26.8.2
Upgrade to Keycloak 26.8.2, 26.6.8 or 26.4.17 (whichever line you run).