Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691) ยท updates https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691 Red Hat disclosed a flaw in Keycloak's SAML HTTP-Redirect binding (keycloak-services): the server accepts percent-encoded parameter names such as %53AMLResponse, while the signature check only looks at the literal parameter names. An unauthenticated attacker can use that mismatch to slip in a crafted, unsigned SAML message that Keycloak processes instead of the legitimately signed one, which leads to full takeover of federated user accounts. Red Hat rates it Important with a CVSS 3.1 score of 9.1 and lists the Red Hat Build of Keycloak as affected; Red Hat Single Sign-On 7 is not affected. No fixed version or acceptable mitigation was listed when the CVE was published on Nov 5 2026, and no exploitation has been reported. en Thu, 05 Nov 2026 00:00:00 GMT Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691): Red Hat publishes CVE-2026-117691 (CVSS 3.1 9.1, Important): percent-encoded parameter names skip SAML signature verification, allowing unsigned messages to be processed and federated accounts taken over. Red Hat says no mitigation currently meets its criteria; no fixed version is listed yet. https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691 https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691#2026-11-05-e0cfb8a8 Thu, 05 Nov 2026 00:00:00 GMT critical <p><a href="https://access.redhat.com/security/cve/CVE-2026-117691">Source</a></p> Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691): Mayssen Aidoudi (Think-it GmbH) reports the SAML redirect-binding signature bypass to Red Hat. https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691 https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691#2026-10-26-9b610cc2 Mon, 26 Oct 2026 00:00:00 GMT critical <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-117691">Source</a></p>