A vulnerability in Keycloak's SAML XML processing allows an unauthenticated remote attacker to cause high CPU usage by sending specially crafted SAML requests with excessively long dateTime or duration values. This leads to a denial of service (DoS) condition affecting all users. The flaw arises from improper validation of these string lengths before XML parsing.