CVE-2026-117691 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
CriticalCVSS 9.1
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat build keycloak | < 26.6.9-1 | 26.6.9-1 |
| redhat build keycloak | < 26.6-25 | 26.6-25 |
| redhat build keycloak | < 26.6-26 | 26.6-26 |
| redhat build keycloak | = 26.6 | No fix listed |
| redhat red hat single sign on | = 7 | No fix listed |
| redhat/rhbk/keycloak-operator-bundle:26.6.9-1(Red Hat:build_keycloak:26.6::el9) | All versions | No fix listed |
| redhat/rhbk/keycloak-rhel9:26.6-25(Red Hat:build_keycloak:26.6::el9) | All versions | No fix listed |
| redhat/rhbk/keycloak-rhel9-operator:26.6-26(Red Hat:build_keycloak:26.6::el9) | All versions | No fix listed |
| redhat/keycloak-services(Red Hat:build_keycloak:26.6::el9) | All versions | No fix listed |
| redhat/rhbk/keycloak-rhel9(Red Hat:build_keycloak:26.6::el9) | All versions | No fix listed |
References
- RHSA-2026:96039 patch vendor-advisory
- RHSA-2026:96040 patch vendor-advisory
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- RHBZ#2561977 issue-tracking
- www.cve.org
- nvd.nist.gov