MEDIUM 5.3
GHSA-fqjh-8322-vgrv
Keycloak Generates an Error Message Containing Sensitive Information
Details
A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.keycloak:keycloak-services
Introduced in:
0 No fixed version published yet for org.keycloak:keycloak-services (maven). Pin to a known-safe version or switch to an alternative.
Maven / org.keycloak:keycloak-services
Introduced in:
26.5.0 Fixed in: 26.6.3 Fix
# pom.xml: bump <version>26.6.3</version> for org.keycloak:keycloak-services References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9794 [ADVISORY]
- https://github.com/keycloak/keycloak/issues/49428 [WEB]
- https://github.com/keycloak/keycloak/pull/49684 [WEB]
- https://github.com/keycloak/keycloak/pull/49686 [WEB]
- https://github.com/keycloak/keycloak/commit/05e98366773eec60878bb2a6d5da6bc7048ac3c8 [WEB]
- https://github.com/keycloak/keycloak/commit/7750e3ff823d1da8580d42c51194feb2e933b87b [WEB]
- https://github.com/keycloak/keycloak/commit/dba79eb03fb9d634fda5e86e1613b8747f968518 [WEB]
- https://access.redhat.com/errata/RHSA-2026:25097 [WEB]
- https://access.redhat.com/errata/RHSA-2026:25098 [WEB]
- https://access.redhat.com/errata/RHSA-2026:30049 [WEB]
- https://access.redhat.com/errata/RHSA-2026:30050 [WEB]
- https://access.redhat.com/security/cve/CVE-2026-9794 [WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2482461 [WEB]
- https://github.com/keycloak/keycloak [PACKAGE]