---
id: "CVE-2026-110931"
kind: "vulnerability"
aliases: ["CVE-2026-110931"]
title: "Keycloak: unauthenticated request crashes the server through a SAML 1.1 AuthorityBinding parser loop"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "keycloak", "fixed": ["26.4.17", "26.6.8", "26.8.2"], "affected": "unknown start; below 26.4.17, 26.6.8, 26.8.2 per release line", "ecosystem": "maven"}]
ecosystems: []
tags: ["identity", "keycloak", "runtime", "saml", "self-hosted"]
not_affected_if: ["oidc-only", "saml-1.1-disabled"]
published_at: "2026-11-05T17:17:37+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:45:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110931", "first_seen_at": "2026-11-05T17:40:03+00:00"}, {"source": "analyst", "url": "https://github.com/keycloak/keycloak/issues/54693", "first_seen_at": "2026-11-05T17:45:19+00:00", "cites": ["https://github.com/keycloak/keycloak/issues/54693", "https://github.com/keycloak/keycloak/releases"]}]
exploit_sources: []
---

# Keycloak: unauthenticated request crashes the server through a SAML 1.1 AuthorityBinding parser loop

A crafted SAML 1.1 AuthorityBinding element sends Keycloak's parser into a loop. Keycloak's issue describes this as an unauthenticated single-request JVM termination (OutOfMemoryError), and says the fix for CVE-2026-7307 was incomplete. Fixed in 26.4.17, 26.6.8 and 26.8.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:keycloak affected unknown start; below 26.4.17, 26.6.8, 26.8.2 per release line fixed 26.4.17, 26.6.8, 26.8.2

## How to check

Run Keycloak's version command or check the admin console's server info. Versions below 26.4.17, 26.6.8 or 26.8.2 on the matching line are not fixed. The first affected version is not stated in the sources I read. Releases before 26.6.2 were already exposed to the earlier CVE-2026-7307. Whether SAML 1.1 parsing is on by default is not stated in the sources, so treat any internet-reachable SAML endpoint as exposed. Self-hosted servers exposing SAML endpoints are the ones to look at; no login is needed.

## Fix

Upgrade to Keycloak 26.8.2, 26.6.8 or 26.4.17 (whichever line you run).

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110931
- 2026-11-05T17:45:19+00:00 analyst https://github.com/keycloak/keycloak/issues/54693 — Keycloak maintainers' issue #54693 (severity/high, labels release/26.4.17, 26.6.8, 26.8.2) and 26.8.2 release notes (5 Nov 2026) list the fix. Issue is an incomplete fix of CVE-2026-7307 (fixed 26.6.2). First affected version and whether SAML 1.1 parsing is default-on are not stated in the sources I read; NVD page returned empty. X not checked.

## Documents

- [advisory] keycloak #54693 CVE-2026-110931 https://github.com/keycloak/keycloak/issues/54693
- [fix] Keycloak 26.8.2 release notes (security fixes) https://github.com/keycloak/keycloak/releases

## From the sources

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_