Keycloak: Authentication bypass via SAML HTTP-Redirect binding (CVE-2026-117691)
A flaw in Keycloak's SAML HTTP-Redirect binding implementation allows an attacker to bypass signature verification using percent-encoded parameter names, potentially leading to full account takeover of federated users.
CVE search metadata
CVE search record: CVE-2026-117691. Severity: critical. CVSS: 9.1. KEV: no. Product: Keycloak. Brief: Keycloak: Authentication bypass via SAML HTTP-Redirect binding (CVE-2026-117691). Brief link: https://feed.craftedsignal.io/briefs/2026-11-keycloak-saml-bypass/
Triage facts
Revision 2- Applicability
- Keycloak
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 5, 16:33 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_products, affected_vendors, claim_state, cpes, has_poc, lastmod, poc_references, references, updates
Sources: 1
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak (CVE-2026-117691). The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.