~ / search / GHSA-fqjh-8322-vgrv

GHSA-fqjh-8322-vgrv

Keycloak Generates an Error Message Containing Sensitive Information

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-9794

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services <= 26.4.7 no fix listed
Maven org.keycloak:keycloak-services >= 26.5.0, < 26.6.3 26.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

References

External links from the advisory. They lead to third-party sites.