GitHub Advisoryadvisory · Maven
GHSA-fqjh-8322-vgrv Keycloak Generates an Error Message Containing Sensitive Information
MEDIUM
Official page ↗
- Aliases
- CVE-2026-9794
- Ecosystem
- Maven
- Packages
- org.keycloak:keycloak-services
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-209
- Reviewed
- 2026-07-01
Affected packages
• Maven org.keycloak:keycloak-services: <= 26.4.7 (no fix yet)
• Maven org.keycloak:keycloak-services: >= 26.5.0, < 26.6.3 → fixed in 26.6.3
Description
A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.
Related
Alias · CVE (1)
- CVE-2026-9794 A flaw was found in Keycloak. vulnerability
Weakness · CWE (1)
- CWE-209 Generation of Error Message Containing Sensitive Information weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9794 advisory
- https://github.com/keycloak/keycloak/issues/49428 web
- https://github.com/keycloak/keycloak/pull/49684 web
- https://github.com/keycloak/keycloak/pull/49686 web
- https://github.com/keycloak/keycloak/commit/05e98366773eec60878bb2a6d5da6bc7048ac3c8 web
- https://github.com/keycloak/keycloak/commit/7750e3ff823d1da8580d42c51194feb2e933b87b web
- https://github.com/keycloak/keycloak/commit/dba79eb03fb9d634fda5e86e1613b8747f968518 web
- https://access.redhat.com/errata/RHSA-2026:25097 web
- https://access.redhat.com/errata/RHSA-2026:25098 web
- https://access.redhat.com/errata/RHSA-2026:30049 web
- https://access.redhat.com/errata/RHSA-2026:30050 web
- https://access.redhat.com/security/cve/CVE-2026-9794 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2482461 web
- https://github.com/keycloak/keycloak package