This vulnerability involves the generation of error messages containing sensitive information in the Red Hat Build of Keycloak. An unauthenticated remote attacker can exploit this by sending specially crafted SOAP requests to the SAML Enhanced Client or Proxy (ECP) endpoint with varying client IDs. The attacker observes distinct faultstrings in the responses that reveal the client's protocol type, leading to information disclosure. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and confidentiality impact only.

The vulnerability allows an unauthenticated remote attacker to gain limited sensitive information about client protocol types by analyzing error messages returned from the SAML ECP endpoint. There is no impact on integrity or availability. This information disclosure could potentially aid further targeted attacks but does not directly compromise system control or data integrity.

As of the current Red Hat advisory, no official patch or remediation level has been published. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9794 for current remediation guidance. Until a fix is available, consider restricting access to the SAML ECP endpoint or monitoring for abnormal SOAP request patterns if feasible.