Bug 2508311 (CVE-2026-18217)

Summary: CVE-2026-18217 keycloak-services: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-29 08:55:02 UTC 
A HTTP Parameter Pollution vulnerability was discovered in Keycloak within the org.keycloak.protocol.saml package. The flaw exists because the SAML HTTP-Redirect binding response preserves the full query string provided in the initial authentication request. An attacker can craft an AuthnRequest with an AssertionConsumerServiceURL that already contains SAMLResponse and RelayState query parameters.
If the SAML client is configured with a wildcard redirect URI and allows the attacker to control these parameters, Keycloak will append its own SAML binding parameters to the existing ones in the redirect response. This results in duplicate parameters where the attacker-controlled values appear first. An attacker can exploit this against service providers that only parse the first occurrence of a query parameter to perform login CSRF or session swapping, effectively forcing a victim to authenticate into an attacker-controlled session.