# Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691) · pwn.watch > Red Hat disclosed a flaw in Keycloak's SAML HTTP-Redirect binding (keycloak-services): the server accepts percent-encoded parameter names such as %53AMLResponse, while the signature check only looks at the literal parameter names. An unauthenticated attacker can use that mismatch to slip in a crafted, unsigned SAML message that Keycloak processes instead of the legitimately signed one, which leads to full takeover of federated user accounts. Red Hat rates it Important with a CVSS 3.1 score of 9.1 and lists the Red Hat Build of Keycloak as affected; Red Hat Single Sign-On 7 is not affected. No fixed version or acceptable mitigation was listed when the CVE was published on Nov 5 2026, and no exploitation has been reported. Page: https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: critical · status: live · patch: unpatched - Product: Keycloak / Red Hat Build of Keycloak (keycloak-services) - Started: 2026-11-05 - CVEs: CVE-2026-117691 - Affected: Red Hat Build of Keycloak (keycloak-services, rhbk/keycloak-rhel9); fixed upstream Keycloak versions not yet announced ## Follow this incident - RSS (one item per update): https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691/feed.xml - JSON Feed: https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691.json - This file: https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691/llms.txt ## Updates (newest first) - 2026-11-05: Red Hat publishes CVE-2026-117691 (CVSS 3.1 9.1, Important): percent-encoded parameter names skip SAML signature verification, allowing unsigned messages to be processed and federated accounts taken over. Red Hat says no mitigation currently meets its criteria; no fixed version is listed yet. (https://access.redhat.com/security/cve/CVE-2026-117691) - 2026-10-26: Mayssen Aidoudi (Think-it GmbH) reports the SAML redirect-binding signature bypass to Red Hat. (https://www.cve.org/CVERecord?id=CVE-2026-117691) ## Fix brief # Security brief: Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691) Source: https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691 · status: live · severity: critical · updated Nov 5, 2026, 14:23 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is Red Hat disclosed a flaw in Keycloak's SAML HTTP-Redirect binding (keycloak-services): the server accepts percent-encoded parameter names such as %53AMLResponse, while the signature check only looks at the literal parameter names. An unauthenticated attacker can use that mismatch to slip in a crafted, unsigned SAML message that Keycloak processes instead of the legitimately signed one, which leads to full takeover of federated user accounts. Red Hat rates it Important with a CVSS 3.1 score of 9.1 and lists the Red Hat Build of Keycloak as affected; Red Hat Single Sign-On 7 is not affected. No fixed version or acceptable mitigation was listed when the CVE was published on Nov 5 2026, and no exploitation has been reported. Severity detail: CVSS 3.1 9.1 (Red Hat, AV:N/AC:L/PR:N/UI:N); unauthenticated takeover of federated users via SAML redirect binding; no fix or mitigation listed yet; no exploitation reported - Product: Keycloak / Red Hat Build of Keycloak (keycloak-services) - CVE / advisory ids: CVE-2026-117691 ## Affected versions - Red Hat Build of Keycloak (keycloak-services, rhbk/keycloak-rhel9); fixed upstream Keycloak versions not yet announced ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes If you run Keycloak with SAML identity providers or SAML clients using the HTTP-Redirect binding, watch for the fixed Keycloak / Red Hat Build of Keycloak release and upgrade as soon as it ships. Until then, review whether you need the Redirect binding for SAML responses and monitor federated logins for anomalies. ## Latest updates - Nov 5, 2026: Red Hat publishes CVE-2026-117691 (CVSS 3.1 9.1, Important): percent-encoded parameter names skip SAML signature verification, allowing unsigned messages to be processed and federated accounts taken over. Red Hat says no mitigation currently meets its criteria; no fixed version is listed yet. - Oct 26, 2026: Mayssen Aidoudi (Think-it GmbH) reports the SAML redirect-binding signature bypass to Red Hat. ## Advisories - [CVE-2026-117691](https://access.redhat.com/security/cve/CVE-2026-117691) (Red Hat) - [CVE-2026-117691](https://www.cve.org/CVERecord?id=CVE-2026-117691) (CVE Program (MITRE)) - [Bugzilla 2561977: SAML redirect binding signature bypass via percent-encoded parameter names](https://bugzilla.redhat.com/show_bug.cgi?id=2561977) (Red Hat Bugzilla) ## Caveats Watch the Keycloak GitHub security advisories and release notes for the fixed versions. --- Machine-readable: https://pwn.watch/i/keycloak-saml-redirect-signature-bypass-cve-2026-117691.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.