A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to
    the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and
    worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
    (CVE-2026-7307)

Keycloak versions installed prior to 26.6.2 are affected by multiple vulnerabilities, including:

  - A flaw was found in Keycloak's redirect URI validation logic. An attacker can bypass     validation to redirect users to malicious sites, potentially leading to phishing attacks and     credential theft. (CVE-2026-7504)

  - A session fixation vulnerability exists in the OIDC login flow. An unauthenticated attacker     can pre-create sessions leading to account takeover if a user logs in using the attacker's     session. (CVE-2026-7507)

  - A flaw was found in Keycloak's SAML endpoint processing. A crafted XML request to the SAML     endpoint can cause a denial of service by consuming excessive server resources. (CVE-2026-7307)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
442628	SCA: security update for org.keycloak:keycloak-saml-core (GHSA-p5mv-gj8j-xqgf)	Tenable Cloud Security	SCA Checks	Local	high
442628	SCA: security update for org.keycloak:keycloak-saml-core (GHSA-p5mv-gj8j-xqgf)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
316461	Keycloak < 26.6.2 Multiple Vulnerabilities	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-7307

high

Tenable Plugins

high

high

medium