A vulnerability in Keycloak's SAML 1.1 XML parsing logic causes an infinite loop when unexpected elements appear in a security token's key information section. This flaw allows an unauthenticated remote attacker to trigger 100% CPU usage, resulting in a denial of service that requires a server restart to recover.