A vulnerability identified as CVE-2026-7307 affects Red Hat build of Keycloak 26.2 versions >=26.2 and <26.2.16. The flaw involves improper validation of syntactic correctness of XML input sent to the SAML endpoint. An unauthenticated remote attacker can exploit this by sending specially crafted XML data that triggers excessive CPU consumption and worker thread starvation, leading to denial of service conditions. Red Hat has addressed this vulnerability in version 26.2.16, releasing security updates for both standalone and OpenShift containerized deployments of Keycloak. The CVSS v3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation of this vulnerability results in denial of service by exhausting server resources, making the Keycloak authentication service unavailable. This can disrupt authentication and single sign-on capabilities for web and mobile applications relying on the affected Keycloak server. There is no impact on confidentiality or integrity reported.

Red Hat has released an official security update in Red Hat build of Keycloak version 26.2.16 that fixes this vulnerability. Users should upgrade affected Keycloak installations to version 26.2.16 or later. Before applying the update, back up all relevant data including applications, configuration files, and databases. No other mitigations or workarounds are specified in the vendor advisory.