#Saml

Keycloak SAML redirect-binding signature bypass lets attackers take over federated accounts (CVE-2026-117691)

Red Hat disclosed a flaw in Keycloak's SAML HTTP-Redirect binding (keycloak-services): the server accepts percent-encoded parameter names such as %53AMLResponse, while the signature check only looks at the literal parameter names. An unauthenticated attacker can use that mismatch to slip in a crafted, unsigned SAML message that Keycloak processes instead of the legitimately signed one, which leads to full takeover of federated user accounts. Red Hat rates it Important with a CVSS 3.1 score of 9.1 and lists the Red Hat Build of Keycloak as affected; Red Hat Single Sign-On 7 is not affected. No fixed version or acceptable mitigation was listed when the CVE was published on Nov 5 2026, and no exploitation has been reported.

Keycloak / Red Hat Build of Keycloak (keycloak-services)·Since Nov 5, 2026·updated Nov 5, 2026, 14:23 UTC