Keycloak SAML Redirect Binding Signature Bypass (CVE-2026-117691)

CVE-2026-117691 is a signature verification flaw in the SAML HTTP-Redirect binding of Keycloak, the open source identity and access management server. Red Hat describes it as a signature bypass that can lead to full account takeover of federated users. Federated users are people who sign in to Keycloak through an external identity provider.

The root cause, per Red Hat, is inconsistent parsing of percent-encoded query parameters. The server decodes percent-encoded parameter names when it processes a SAML message. The signature check looks only at literal parameter names, so the two steps can disagree about which message was signed.

What an Attacker Gains

Red Hat's description says an attacker can supply a crafted, unsigned SAML message that the server processes instead of a legitimately signed one. Its product security team rates the flaw Important and says successful exploitation lets an attacker log in as any user and access that user's roles and data without authorization.

Red Hat's bug entry adds a precondition. It says the attacker needs an account at the external identity provider, to obtain a validly signed redirect-binding message. We leave out the message details on purpose. Our NetScaler SAML flaw page covers another SAML weakness.

How the Score Reads

Red Hat, the CNA, scores it CVSS 3.1 9.1 Critical with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Red Hat's page calls the score preliminary and subject to review. NVD lists Red Hat's score as secondary and shows the entry as undergoing analysis on 5 November 2026.

There is no CVSS 4.0 score in the record or NVD. Red Hat sets availability impact to none, so the score reflects loss of confidentiality and integrity only. See our CVSS entry for how to read the vector.

What Red Hat, CISA SSVC and KEV Say

Red Hat says mitigation is either not available or does not meet its criteria for ease of use, applicability and stability. CISA's SSVC record in the CVE entry lists exploitation as none, automatable as yes and technical impact as total, dated 5 November 2026.

As of CISA catalog version 2026.11.04, the CVE is not in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog.

The CVE record names two Red Hat products as affected: Red Hat Build of Keycloak, as the keycloak-services package and the rhbk/keycloak-rhel9 container image. It lists Red Hat Single Sign-On 7 (keycloak-services) as unaffected. The record gives no version ranges and no fixed version.

The record does not state whether upstream Keycloak releases or other vendors' builds are affected, and it names no fixed release. Red Hat's bug entry was still in status NEW on 5 November 2026. We recommend reading Red Hat's CVE page for the current fix status of your build, and the Keycloak project's own security page for community releases.

Red Hat credits Mayssen Aidoudi of Think-it GmbH for reporting the issue, which Red Hat received on 26 October 2026. Our vulnerability management guide covers how to track a flaw whose fix is not yet published.