A critical flaw in Keycloak's SAML HTTP-Redirect binding lets an unauthenticated attacker get a crafted, unsigned SAML message processed, which can lead to full takeover of federated user accounts.
What Is It
CVE-2026-117691 is a signature verification flaw (CWE-347, Improper Verification of Cryptographic Signature) in Keycloak's SAML HTTP-Redirect binding. The server accepts percent-encoded parameter names such as %53AMLResponse, but the signature verification logic checks only the literal parameter names. An attacker can use this mismatch to send a crafted, unsigned SAML message. The server then processes that message in place of a legitimately signed one.
Red Hat published the issue on November 5, 2026. NVD lists its status as "Awaiting Analysis."
Why It Matters
Red Hat rates the flaw 9.1 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:
- Network-reachable, with low attack complexity
- No privileges and no user interaction required
- High impact on confidentiality and integrity
According to the advisory, successful exploitation leads to full account takeover of federated users. Keycloak is often the identity broker in front of downstream applications, so one bypass at the SAML layer can give an attacker access to every service that trusts that identity provider.
Exploitation status: At the time of writing, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. That status can change, so check the catalog for updates.
What's Vulnerable
Red Hat's affected-product data lists:
| Product | Package | Status |
|---|---|---|
| Red Hat Build of Keycloak | keycloak-services |
Affected |
| Red Hat Build of Keycloak | rhbk/keycloak-rhel9 |
Affected |
| Red Hat Single Sign-On 7 | keycloak-services |
Unaffected |
The source data does not give specific affected or fixed version ranges. Based on the advisory's description, deployments running an affected package that use the SAML HTTP-Redirect binding with federated users appear to be the most likely to be exposed. Red Hat has not published specific exploitation preconditions, so confirm exposure against the advisory as more detail becomes available.
Patch Status
The supplied source data does not include fixed versions or a required action. Because the CVE is not currently listed in the CISA KEV catalog, there is no KEV remediation deadline. Administrators running Red Hat Build of Keycloak should:
- Monitor the Red Hat CVE page and Bugzilla entry below for errata and fixed package versions
- Apply updates to
keycloak-servicesand therhbk/keycloak-rhel9container image when Red Hat releases them - Inventory which realms and clients use the SAML HTTP-Redirect binding, so you know your exposure
Sources
- Red Hat Security Advisory: CVE-2026-117691
- Red Hat Bugzilla #2561977
- CISA Known Exploited Vulnerabilities Catalog
- NVD CVE Record: CVE-2026-117691 (source: [email protected])