GHSA-fqjh-8322-vgrv
Keycloak Generates an Error Message Containing Sensitive Information
At a glance
- Published
- Updated
- CVE
- CVE-2026-9794
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-services | introduced 0, last affected 26.4.7 |
| Maven · org.keycloak:keycloak-services | introduced 26.5.0, fixed 26.6.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9794 ADVISORY
- https://github.com/keycloak/keycloak/issues/49428 WEB
- https://github.com/keycloak/keycloak/pull/49684 WEB
- https://github.com/keycloak/keycloak/pull/49686 WEB
- https://github.com/keycloak/keycloak/commit/05e98366773eec60878bb2a6d5da6bc7048ac3c8 WEB
- https://github.com/keycloak/keycloak/commit/7750e3ff823d1da8580d42c51194feb2e933b87b WEB
- https://github.com/keycloak/keycloak/commit/dba79eb03fb9d634fda5e86e1613b8747f968518 WEB
- https://access.redhat.com/errata/RHSA-2026:25097 WEB
- https://access.redhat.com/errata/RHSA-2026:25098 WEB
- https://access.redhat.com/errata/RHSA-2026:30049 WEB
- https://access.redhat.com/errata/RHSA-2026:30050 WEB
- https://access.redhat.com/security/cve/CVE-2026-9794 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2482461 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |