CVE-2026-117691: Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
Other sources
A signature bypass vulnerability was identified in Keycloak's SAML HTTP-Redirect binding. The root cause is a discrepancy between how the server parses query parameters for processing versus how it parses them for signature verification. Specifically, the server decodes percent-encoded parameter names (e.g., %53AMLResponse becomes SAMLResponse) during processing, but the signature verification logic re-parses the raw query string and only recognizes literal parameter names. By sending a GET request where a crafted, unsigned SAMLResponse is placed first using a percent-encoded name, followed by a legitimately signed SAMLResponse, an attacker can bypass the signature check. The signature check validates the second (legitimate) message, but the server processes the first (crafted) message because it is the first occurrence of the decoded parameter name. Successful exploitation allows an unauthenticated remote attacker to perform a full account takeover of any federated user by impersonating their identity in the SAML assertion. This requires the attacker to have their own account at the external Identity Provider to capture a validly signed redirect-binding message (such as a logout response) to use in the bypass. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
— Red Hat