CVE-2026-117691: Keycloak SAML Signature Bypass

SAML signature bypass in Keycloak via percent-encoded parameters (CVSS 9.1): federated user account takeover.

CVE-2026-117691 is a critical vulnerability in Keycloak's SAML HTTP-Redirect binding. The flaw exploits a discrepancy between parameter parsing and signature verification: the server processes percent-encoded names (%53AMLResponse instead of SAMLResponse) while signature verification only checks literal names. An attacker submits a crafted, unsigned SAML message processed by the server instead of a legitimate one.

With CVSS 9.1 (critical), the impact is complete account takeover of SAML-authenticated users without prior authentication. Remotely exploitable. Published on NVD November 5, 2026, with 2 reports on X in the last 24 hours (5 interactions). No confirmed public exploit in known repositories.

Verify Keycloak version and consult the official advisory for patches. Plan prioritized upgrade. Analyze SAML logs from the week before publication for anomalies and unauthorized sessions. Test patches in non-production first. Until a fix is available, strengthen access controls and intensify SAML service monitoring.

At a glance

What: CVE-2026-117691 is a flaw in Keycloak's SAML HTTP-Redirect binding implementation. The server processes percent-encoded parameter names (e.g., %53AMLResponse) while signature verification only checks literal names. An attacker submits a crafted, unsigned SAML message processed by the server instead of a legitimately signed one.
Severity: CVSS 9.1 (critical). Impact: complete account takeover of federated users. Access requires no prior authentication. Reachable remotely.
Affected versions: Not reported in official NVD description. Verify official Keycloak documentation and project security bulletin.
Fix: Not reported. Await security update from Keycloak project. Monitor official advisories for patches and corrected versions.
Status: Published on NVD 2026-11-05. Reported on X in last 24 hours (2 posts, 5 total interactions). No confirmed public exploit in known repositories.
Action: 1. Verify Keycloak version in use. 2. Consult official Keycloak security advisory. 3. Plan prioritized upgrade. 4. Analyze SAML logs for anomalies and unauthorized sessions from preceding week. 5. Test patch in non-production environment before production deployment.

Sources: NVD, CVE-2026-117691

← All articles