5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9794

CVE-2026-9794: Keycloak Generates an Error Message Containing Sensitive Information

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9794

CVE-2026-9794:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	<= 26.4.7
org.keycloak:keycloak-services	maven	>= 26.5.0, < 26.6.3	26.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the SAML ECP endpoint implementation in Keycloak, specifically in how it handles errors during the authentication process. The authenticate method in org.keycloak.protocol.saml.profile.ecp.SamlEcpProfileService processes incoming SOAP requests.

The patch analysis reveals that within this method, an anonymous inner class is used to handle protocol binding. This inner class overrides an error method. In the vulnerable version, this error method would create a SOAP fault response where the fault's "reason" was populated with a detailed error message (message).

The vulnerability arises because this message could contain sensitive information about the server's state or the configuration of the client being targeted. By sending crafted requests with different client IDs, an attacker could trigger different error conditions and inspect the fault reasons in the SOAP responses to infer information, such as whether a client exists and what its protocol settings are.

The fix replaces the detailed, variable error message in the SOAP fault with a static, generic message: "Authentication request cannot be processed.". The original detailed message is now only logged on the server side for debugging purposes.

Therefore, the authenticate function is the key function that would appear in a runtime profile when this vulnerability is triggered, as it is the entry point for the vulnerable logic that generates the information-leaking error response.

Vulnerable functions

org.keycloak.protocol.saml.profile.ecp.SamlEcpProfileService.authenticate

services/src/main/java/org/keycloak/protocol/saml/profile/ecp/SamlEcpProfileService.java

The `authenticate` method contains an inner class that overrides the `error` method. In the vulnerable version, this `error` method created a SOAP fault with a reason string (`message`) that contained sensitive information about the client's configuration. An attacker could use this to enumerate client configurations. The patch replaces the detailed error message with a generic one.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.