A remote, unauthenticated attacker can send crafted SOAP requests to the SAML ECP endpoint in Keycloak, using different client IDs. The endpoint responds with distinct faultstrings for each request, allowing the attacker to deduce the client's protocol type and thereby learn information that should not be exposed. This flaw has a CVSS score of 5.3, indicating a moderate risk level for confidentiality.

Red Hat Build of Keycloak. No specific version details are provided in the CNA data, so all releases of the Red Hat Keycloak build are potentially vulnerable.

The vulnerability is exploitable remotely without authentication and operates entirely through the SAML ECP endpoint. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, which suggests that active exploitation is presently unreported or limited. However, the attack vector is straightforward and could be used by threat actors who signal Keycloak installations, especially if the endpoint is exposed to the internet. The moderate CVSS score reflects the potential for information leakage, but lack of a patch and the absence of an official workaround leave administrators without a definitive fix at this time.