{"id":"CVE-2026-117691","published":"2026-11-05T14:17:01.320","lastModified":"2026-11-05T17:17:44.750","description":"A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-117691","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561977","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Keycloak's SAML HTTP-Redirect binding incorrectly processes percent-encoded parameter names (e.g., %53AMLResponse) while verifying signatures over literal parameter names, allowing attackers to inject unsigned SAML messages that bypass signature validation and enable full account takeover of federated users.","exploitability":"Exploitation requires the attacker to craft a malicious SAML HTTP-Redirect request with a percent-encoded parameter name and no valid signature; it is straightforward for an attacker who understands SAML redirects and has access to the authentication endpoint.","blast_radius":"Successful exploitation grants full account takeover of any federated user, enabling unauthorized access to protected resources without credentials.","remediation":"Upgrade to Keycloak 26.1.0 or later, where the server now decodes percent-encoded parameter names before signature verification, ensuring consistent handling of SAML parameters.","detection":"Look for HTTP requests to the SAML SSO endpoint containing percent-encoded parameter names (e.g., %53AMLResponse instead of SAMLResponse) in query strings; such encoding is rare in legitimate SAML redirects and may indicate manipulation.","tags":["saml","auth-bypass","account-takeover","web","federation"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:46:05.999Z"}}