CVE-2026-117691

Summary

Keycloak's SAML HTTP-Redirect binding incorrectly processes percent-encoded parameter names (e.g., %53AMLResponse) while verifying signatures over literal parameter names, allowing attackers to inject unsigned SAML messages that bypass signature validation and enable full account takeover of federated users.

Exploitability

Exploitation requires the attacker to craft a malicious SAML HTTP-Redirect request with a percent-encoded parameter name and no valid signature; it is straightforward for an attacker who understands SAML redirects and has access to the authentication endpoint.

Blast radius

Successful exploitation grants full account takeover of any federated user, enabling unauthorized access to protected resources without credentials.

Detection

Look for HTTP requests to the SAML SSO endpoint containing percent-encoded parameter names (e.g., %53AMLResponse instead of SAMLResponse) in query strings; such encoding is rare in legitimate SAML redirects and may indicate manipulation.

Prioritized remediation

Upgrade to Keycloak 26.1.0 or later, where the server now decodes percent-encoded parameter names before signature verification, ensuring consistent handling of SAML parameters.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.