Keycloak Information Disclosure Vulnerability via SAML ECP Endpoint

An information disclosure vulnerability exists in Keycloak. A remote, unauthenticated attacker can exploit this flaw by sending specially crafted SOAP requests to the SAML ECP (Enhanced Client or Proxy) endpoint, using different client IDs. By analyzing the distinct faultstrings in the responses, the attacker can infer the client's protocol type, leading to unauthorized information disclosure.

Impact

Exploitation of this vulnerability allows for unauthorized enumeration of client protocol types, which could facilitate further targeted attacks.