CVE-2026-110931
Last modified
CVE-2026-110931 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement.
Description
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Build of Keycloak | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-110931?
How severe is CVE-2026-110931?
How do I fix CVE-2026-110931?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110923Rejected reason: CVE-2026-110923 has been marked as a duplic…
- CVE-2026-110924Rejected reason: CVE-2026-110924 has been marked as a duplic…
- CVE-2026-110925Rejected reason: CVE-2026-110925 has been marked as a duplic…
- CVE-2026-110926Rejected reason: CVE-2026-110926 has been marked as a duplic…
- CVE-2026-110927Rejected reason: CVE-2026-110927 has been marked as a duplic…
- CVE-2026-11093Inappropriate implementation in Printing in Google Chrome pr…6.5
- CVE-2026-110932A flaw was found in the theme resource endpoint of Keycloak,…7.5
- CVE-2026-110933Uncaught exception vulnerability in Samsung Open Source Vyon…4.4
- CVE-2026-110934Improper validation of array index vulnerability in Samsung …4.4
- CVE-2026-110935The PFI plugin framework deployment routine does not validat…8.4
- CVE-2026-110936A vulnerability has been identified in Siemens Software Cent…6.7
- CVE-2026-110938In Eclipse OpenJ9 versions up to 0.63.0, the JITServer compo…8.7
Are you affected by CVE-2026-110931?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST