{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691) · updates",
  "home_page_url": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691",
  "feed_url": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691/feed.json",
  "description": "Red Hat disclosed a flaw in Keycloak's SAML HTTP-Redirect binding (keycloak-services): the server accepts percent-encoded parameter names such as %53AMLResponse, while the signature check only looks at the literal parameter names. An unauthenticated attacker can use that mismatch to slip in a crafted, unsigned SAML message that Keycloak processes instead of the legitimately signed one, which leads to full takeover of federated user accounts. Red Hat rates it Important with a CVSS 3.1 score of 9.1 and lists the Red Hat Build of Keycloak as affected; Red Hat Single Sign-On 7 is not affected. No fixed version or acceptable mitigation was listed when the CVE was published on Nov 5 2026, and no exploitation has been reported.",
  "language": "en",
  "_pwn": {
    "slug": "keycloak-saml-redirect-signature-bypass-cve-2026-117691",
    "severity": "critical",
    "status": "live",
    "patchStatus": "unpatched",
    "rss": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691/feed.xml",
    "llms": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691/llms.txt",
    "json": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691#2026-11-05-e0cfb8a8",
      "url": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691#2026-11-05-e0cfb8a8",
      "title": "Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691): Red Hat publishes CVE-2026-117691 (CVSS 3.1 9.1, Important): percent-encoded parameter names skip SAML signature verification, allowing unsigned messages to be processed and federated accounts taken over. Red Hat says no mitigation currently meets its criteria; no fixed version is listed yet.",
      "content_text": "Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691): Red Hat publishes CVE-2026-117691 (CVSS 3.1 9.1, Important): percent-encoded parameter names skip SAML signature verification, allowing unsigned messages to be processed and federated accounts taken over. Red Hat says no mitigation currently meets its criteria; no fixed version is listed yet.\n\nSource: https://access.redhat.com/security/cve/CVE-2026-117691",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://access.redhat.com/security/cve/CVE-2026-117691",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691#2026-10-26-9b610cc2",
      "url": "https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691#2026-10-26-9b610cc2",
      "title": "Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691): Mayssen Aidoudi (Think-it GmbH) reports the SAML redirect-binding signature bypass to Red Hat.",
      "content_text": "Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691): Mayssen Aidoudi (Think-it GmbH) reports the SAML redirect-binding signature bypass to Red Hat.\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-117691",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-117691",
      "tags": [
        "critical"
      ]
    }
  ]
}