Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Keycloak SAML redirect signature bypass allows account takeover

CVE-2026-117691 · published 2 days ago
Summary

The SAML login process in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 can be tricked by using specially encoded parameter names, bypassing signature checks. This lets an attacker create a fake login message and take over user accounts. Apply the latest security updates from Red Hat or disable the HTTP-Redirect binding for SAML until the fix is in place.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
red hat red hat build of keycloak All versions
red hat red hat single sign-on 7 All versions
Original advisory text
Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Sources
CVE-2026-117691 · NVD
CVE-2026-117691 · MITRE
Track software like this
Free during beta