CVE-2026-110931: high-severity vulnerability in Red Hat Build of Keycloak
Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Related CVEs — Red Hat Build of Keycloak
In the same product, most dangerous first.
CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 4.7%CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2023-5685HIGHXnio: stackoverflowexception when the chain of notifier states becomes problematically bigEPSS 3.5%CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2026-76166MEDIUMModcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagramEPSS 2.7%