{"id":"CVE-2026-117691","kind":"vulnerability","aliases":["CVE-2026-117691"],"related":[],"title":"Keycloak: SAML broker redirect login accepts a forged response under a percent-encoded parameter name, allowing account takeover; no fixed version yet","description":"A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.","summary":"Keycloak's SAML broker takes the response from a percent-encoded parameter name (SAML%52esponse) while the signature check reads the raw names, so an attacker with one genuinely signed redirect from the IdP can log in as any user. A public PoC exists for 26.8.1; no fix is published.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak","fixed":[],"affected":"26.8.1 confirmed; earlier releases likely (26.7.5 same code per secondary source)","ecosystem":"vendor"},{"name":"Red Hat Build of Keycloak","fixed":[],"affected":"listed as affected, versions not stated","ecosystem":"vendor"}],"ecosystems":[],"tags":["keycloak","red-hat-build-of-keycloak","runtime","saml","self-hosted","sso"],"not_affected_if":["no-saml","oidc-only","post-binding-only","want-assertions-signed"],"how_to_check":"- Version: kc.sh --version or the image tag. 26.8.1 is confirmed vulnerable by the researcher; 26.7.5 has the same code shape per a secondary analysis, so treat all current releases as exposed.\n- Admin console > Identity providers: you are exposed if a SAML provider has 'Validate Signatures' on, 'Want Assertions Signed' off, and the IdP signs HTTP-Redirect responses (SigAlg and Signature in the query string).\n- Not exposed: no SAML brokering, OIDC only, or an IdP that only uses HTTP-POST.\n- Also check if you use Red Hat Build of Keycloak; Red Hat lists it as affected.","fix":"No fixed version published as of 2026-11-05. Red Hat's page lists none and says no mitigation is available. Keycloak 26.8.1 (13 Oct 2026) fixes the related semicolon variant (#53354) but a researcher reproduced this one on 26.8.1. Watch https://github.com/keycloak/keycloak/releases. Until then, set 'Want Assertions Signed' on every SAML identity provider that signs HTTP-Redirect responses (the researcher says this blocks it; the setting is off by default after metadata import) — not confirmed by the vendor.","status":"open","published_at":"2026-11-05T14:17:01+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:17+00:00","updated_at":"2026-11-05T14:41:45+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T14:40:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: SAML redirect signature bypass allows full account takeover","impact":"high","summary":"Keycloak decodes percent-encoded SAML parameter names, but its signature check only matches literal names, so an unsigned SAML message is accepted. An attacker who can send such a message can log in as federated users and take over their accounts.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","saml","sso","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as federated users and takes over their accounts","analyst_note":"Find the affected and fixed Keycloak version ranges and any vendor advisory; the NVD entry alone gives no versions.","how_to_check":"- Check the Keycloak version with `kc.sh --version` or the image tag in your deployment.\n- Check whether SAML identity brokering or SAML clients using the HTTP-Redirect binding are configured in the realm.\n- unknown for whether a specific deployment is exposed beyond this.","plain_action":"","needs_analyst":true,"not_affected_if":["no-saml","oidc-only"],"who_is_affected":"Deployments of Keycloak that accept SAML logins over the HTTP-Redirect binding, including SAML identity brokering to federated identity providers, are exposed. Keycloak instances that only use OIDC or do not accept SAML requests are likely not affected. The sources do not list affected or fixed versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4259,"output_tokens":568,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed Keycloak version ranges and any vendor advisory; the NVD entry alone gives no versions.","search":"'-117691':26A,29A '-2026':25A,28A '26.8.1':95B '52esponse':64B '53amlresponse':127C 'accept':6A 'account':18A,164C 'allow':17A 'attack':75B,139C 'bind':110C 'broker':3A,52B 'build':33A,40B 'check':68B,134C 'craft':147C 'cve':24A,27A 'discrep':143C 'encod':14A,60B,123C 'exist':93B 'feder':167C 'fix':21A,97B 'flaw':101C 'forg':8A 'found':103C 'full':163C 'genuin':78B 'hat':32A,39B 'host':47B 'http':108C 'http-redirect':107C 'idp':83B 'implement':111C 'instead':155C 'issu':115C 'keycloak':1A,30A,35A,36B,42B,49B,113C 'lead':161C 'legitim':158C 'like':126C 'liter':135C 'log':85B 'logic':132C 'login':5A 'messag':150C 'name':16A,62B,72B,125C,137C 'occur':116C 'of':34A 'one':77B,160C 'paramet':15A,61B,124C,136C 'percent':13A,59B,122C 'percent-encod':12A,58B,121C 'poc':92B 'process':120C,154C 'provid':145C 'public':91B 'publish':99B 'raw':71B 'read':69B 'red':31A,38B 'red-hat-build-of-keycloak':37B 'redirect':4A,80B,109C 'respons':9A,55B 'runtim':43B 'saml':2A,44B,51B,63B,106C,149C 'self':46B 'self-host':45B 'server':119C,153C 'sign':79B,159C 'signatur':67B,130C 'sso':48B 'take':53B 'takeov':19A,165C 'unsign':148C 'use':141C 'user':89B,168C 'verif':131C 'version':22A 'yet':23A","nicknames":[],"mitigations":[],"who_affected":"Keycloak realms that broker to an external SAML identity provider using the HTTP-Redirect binding with signature validation on and 'Want Assertions Signed' off (the usual result of importing IdP metadata). An outsider who gets one genuine signed redirect from that IdP can log in as, or create, any user the realm trusts by NameID. Red Hat Build of Keycloak is listed as affected. OIDC-only realms, realms with no SAML broker, and IdPs that only use POST can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hatbuildofkeycloak","keycloak","redhatbuildofkeycloak"],"ptokens":["build","hat","keycloak","of","red"],"labels":["critical","keycloak","redhatbuildofkeycloak","runtime","saml","selfhosted","sso"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-117691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117691","severity":null,"published_at":"2026-11-05T14:17:01+00:00","modified_at":"2026-11-05T14:17:01+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117691:1784","url":"https://access.redhat.com/security/cve/CVE-2026-117691","severity":null,"published_at":"2026-11-05T14:41:45+00:00","modified_at":"2026-11-05T14:41:45+00:00","first_seen_at":"2026-11-05T14:41:45+00:00","fetched_at":"2026-11-05T14:41:45+00:00","note":"Red Hat CVE page (CNA, reporter Mayssen Aidoudi) gives no versions or fix. Public PoC from Abraxas Labs reproduces percent-encoded name split on 26.8.1 with preconditions (signature validation on, wantAssertionsSigned off, IdP signs redirect). Distinct from #53354 (semicolon, fixed in 26.8.1). No in-the-wild exploitation seen. Researcher rated 7.4 (AC:H), Red Hat 9.1; severity left. Nothing marked verified: no vendor fixed-version statement. Note: researcher's page does not cite this CVE id; mapping is by matching description.","cites":["https://access.redhat.com/security/cve/CVE-2026-117691","https://abraxaslabs.tech/research/keycloak-saml-redirect-param-split","https://github.com/keycloak/keycloak/issues/53354"]}],"documents":[{"id":76986,"url":"https://access.redhat.com/security/cve/CVE-2026-117691","title":"Red Hat: CVE-2026-117691","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":76988,"url":"https://abraxaslabs.tech/research/keycloak-saml-redirect-param-split","title":"Abraxas Labs: Keycloak 26.8.1, SAML redirect query-name split","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":76989,"url":"https://github.com/keycloak/keycloak/issues/53354","title":"Keycloak #53354: SAML broker redirect ';' separator (sibling, fixed in 26.8.1)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://abraxaslabs.tech/research/keycloak-saml-redirect-param-split"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}