VulnSocial

CVE-2026-9794Disclosure(redhat / build_of_keycloak)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

redhat CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-209

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • build_of_keycloak

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-05-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
redhat
Products
build_of_keycloak

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-28: 1Mentions · 2026-06-03: 1Technical Details · 2026-05-28: 1Technical Details · 2026-06-03: 105-2806-03
Signal classification1 categories
Disclosure
2100.0%
Referenced assets6 URLs
Full discourse2 posts
  • White Rabbitx 🏴‍☠️@TheRabbitPy
    Disclosure

    More Keycloak flaws impact SAML, JWE handling, OIDC policies, and data exposure. Attackers can enumerate clients, bypass signature enforcement, evade client policy restrictions, and leak organization metadata. Also: Acer NitroSense LPE via weak named pipe ACL. CVE-2026-9794 https://nvd.nist.gov/vuln/detail/CVE-2026-9794 CVE-2026-9793 https://nvd.nist.gov/vuln/detail/CVE-2026-9793 CVE-2026-9792 https://nvd.nist.gov/vuln/detail/CVE-2026-9792 CVE-2026-9791 https://nvd.nist.gov/vuln/detail/CVE-2026-9791 CVE-2026-9789 https://nvd.nist.gov/vuln/detail/CVE-2026-9789

    Post summary

    The post outlines several newly disclosed Keycloak vulnerabilities that allow client enumeration, bypass of signature enforcement, policy evasion, and metadata leakage, without providing PoCs, exploit code, active exploitation reports, or patches.

    1003091
    1.8K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🟠 Keycloak: Information Disclosure via SAML ECP Endpoint, #CVE-2026-9794 (Medium) -DC-Jun2026-171 https://dailycve.com/keycloak-information-disclosure-via-saml-ecp-endpoint-cve-2026-9794-medium-dc-jun2026-171/

    Post summary

    The text announces a Keycloak vulnerability (CVE‑2026‑9794) involving information disclosure through the SAML ECP endpoint, without providing any PoC, exploit code, or remediation details.

    0000041
    208 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appredhatbuild_of_keycloak---

Explore more

Back to dashboardredhat CVEsbuild_of_keycloak vulnerabilities