A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-9794 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2482461 | Issue Tracking Vendor Advisory |
Configurations
History
03 Jun 2026, 19:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat
Redhat build Of Keycloak |
|
| CPE | cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:* | |
| References | () https://access.redhat.com/security/cve/CVE-2026-9794 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2482461 - Issue Tracking, Vendor Advisory |
28 May 2026, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-28 05:16
Updated : 2026-06-03 19:37
NVD link : CVE-2026-9794
Mitre link : CVE-2026-9794
CVE.ORG link : CVE-2026-9794
JSON object : View
Products Affected
redhat
- build_of_keycloak
CWE
CWE-209
Generation of Error Message Containing Sensitive Information