KEYCLOAK · CVE-2026-117691 · Runtime
NO FIX YET · SEE WHAT TO DO
Keycloak's SAML broker takes the response from a percent-encoded parameter name (SAML%52esponse) while the signature check reads the raw names, so an attacker with one genuinely signed redirect from the IdP can log in as any user. A public PoC exists for 26.8.1; no fix is published.
first public Nov 5, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Keycloak realms that broker to an external SAML identity provider using the HTTP-Redirect binding with signature validation on and 'Want Assertions Signed' off (the usual result of importing IdP metadata). An outsider who gets one genuine signed redirect from that IdP can log in as, or create, any user the realm trusts by NameID. Red Hat Build of Keycloak is listed as affected. OIDC-only realms, realms with no SAML broker, and IdPs that only use POST can skip it.
Not affected if no-saml, oidc-only, post-binding-only, want-assertions-signed
Who cares keycloak, red-hat-build-of-keycloak, saml, self-hosted, sso
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
26.8.1 (13 Oct 2026) fixes the related semicolon variant (#53354) but a researcher reproduced this one on 26.8.1Want Assertions Signed on every SAML identity provider that signs HTTP-Redirect responses (the researcher says this blocks it; the setting is off by default after metadata import) — not confirmed by the vendorNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.