CVE-2026-7307
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A flaw was found in Keycloak where a remote, unauthenticated attacker can send a specially crafted XML input to the SAML endpoint, causing high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) and server unavailability.
Risk Assessment
The risk is that an attacker can easily trigger server overload without authentication, causing service disruption and potential financial loss or loss of customer trust.
Recommendation
It is recommended to immediately update Keycloak to the latest patched version and, if possible, temporarily restrict access to the SAML endpoint to trusted IP addresses.
Original NVD description (English source)
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.