Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691)
Keycloak / Red Hat Build of Keycloak (keycloak-services)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Red Hat disclosed a flaw in Keycloak's SAML HTTP-Redirect binding (keycloak-services): the server accepts percent-encoded parameter names such as %53AMLResponse, while the signature check only looks at the literal parameter names. An unauthenticated attacker can use that mismatch to slip in a crafted, unsigned SAML message that Keycloak processes instead of the legitimately signed one, which leads to full takeover of federated user accounts. Red Hat rates it Important with a CVSS 3.1 score of 9.1 and lists the Red Hat Build of Keycloak as affected; Red Hat Single Sign-On 7 is not affected. No fixed version or acceptable mitigation was listed when the CVE was published on Nov 5 2026, and no exploitation has been reported.
Why this severity: CVSS 3.1 9.1 (Red Hat, AV:N/AC:L/PR:N/UI:N); unauthenticated takeover of federated users via SAML redirect binding; no fix or mitigation listed yet; no exploitation reported
- Started
- Nov 5, 2026
Affected
- Red Hat Build of Keycloak (keycloak-services, rhbk/keycloak-rhel9); fixed upstream Keycloak versions not yet announced
Fixed in
No fixed release yet
Timeline2
Red Hat publishes CVE-2026-117691 (CVSS 3.1 9.1, Important): percent-encoded parameter names skip SAML signature verification, allowing unsigned messages to be processed and federated accounts taken over. Red Hat says no mitigation currently meets its criteria; no fixed version is listed yet.
Mayssen Aidoudi (Think-it GmbH) reports the SAML redirect-binding signature bypass to Red Hat.
Advisories3
Notes & caveats
Watch the Keycloak GitHub security advisories and release notes for the fixed versions.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
