SAML Vulnerability in Keycloak Identity Management Solution
CVE-2026-82965

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
5 November 2026

What is CVE-2026-82965?

A vulnerability exists within the SAML implementation of Keycloak, an open-source identity and access management tool by Red Hat. The issue arises from the SAML Artifact Resolution and ECP SOAP endpoints which fail to restrict the size or complexity of incoming XML requests. An unauthenticated remote attacker could exploit this vulnerability by sending specifically crafted, oversized XML messages. This can lead to excessive memory consumption on the server, resulting in application crashes and subsequent denial of service for all users, effectively interrupting service availability.

References

https://access.redhat.com/security/cve/CVE-2026-82965
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526302
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.