Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
Affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use the SAML HTTP-Redirect binding. CVSS rates it critical at 9.1. No fixed version is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The checked facts name no workaround. The only feature the facts tie to the flaw is the SAML HTTP-Redirect binding, so limiting use of that binding is the option they point to until a fix is released.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 45/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
A flaw in the SAML HTTP-Redirect binding of Keycloak lets an attacker remotely, without logging in, send a crafted unsigned SAML message that the server accepts because signature checks miss percent-encoded parameter names. This can lead to full account takeover of federated users.
Read the original description
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
cve.now Index
- Exploitation0/40No signal
- Exposure20/25No login or user action needed, CISA rates it automatable · Unknown: Advisories don't say whether default setups are affected
- Reach10/20Shipped in major Linux distributions
- Severity10/10CVSS 9.1, total technical impact per CISA
- No patch5/5No patch listed yet
What would change the score
- Would score about 90 if added to CISA KEV
- Would score about 85 if CISA's SSVC rates exploitation active
- Would score about 50 if advisories confirm default setups are exposed
What to do
Workaround: The checked facts name no workaround. The only feature the facts tie to the flaw is the SAML HTTP-Redirect binding, so limiting use of that binding is the option they point to until a fix is released.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- keycloak-services
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- keycloak-services
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-117691
Is CVE-2026-117691 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The SAML HTTP-Redirect binding in Keycloak can be bypassed by using percent-encoded parameter names, which skips the signature check on redirect-binding messages. An attacker who has an account at an external Identity Provider could capture a validly signed message and use it to impersonate federated users, potentially leading to full account takeover.Source: access.redhat.com, bugzilla.redhat.com
Am I affected, and how do I check?
Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are listed as affected, but the checked facts give no version ranges. To check a deployment, confirm whether it uses the SAML HTTP-Redirect binding in its identity provider or client settings, and check the installed Keycloak version against the advisory.Source: access.redhat.com, bugzilla.redhat.com
How do I fix CVE-2026-117691?
The checked facts do not name a fixed version, so take the fixed release from the Red Hat advisory and upgrade to it. Until then, treat the SAML HTTP-Redirect binding as the feature to review.Source: access.redhat.com, bugzilla.redhat.com
What if there's no patch?
The checked facts name no workaround. The only feature the facts tie to the flaw is the SAML HTTP-Redirect binding, so limiting use of that binding is the option they point to until a fix is released.Source: access.redhat.com, bugzilla.redhat.com