Bug 2561977 (CVE-2026-117691)

Summary: CVE-2026-117691 keycloak-services: keycloak-services: SAML redirect binding signature bypass via percent-encoded parameter names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2027-01-24   

Description OSIDB Bzimport 2026-10-27 13:50:49 UTC 
A signature bypass vulnerability was identified in Keycloak's SAML HTTP-Redirect binding. The root cause is a discrepancy between how the server parses query parameters for processing versus how it parses them for signature verification. Specifically, the server decodes percent-encoded parameter names (e.g., %53AMLResponse becomes SAMLResponse) during processing, but the signature verification logic re-parses the raw query string and only recognizes literal parameter names.
By sending a GET request where a crafted, unsigned SAMLResponse is placed first using a percent-encoded name, followed by a legitimately signed SAMLResponse, an attacker can bypass the signature check. The signature check validates the second (legitimate) message, but the server processes the first (crafted) message because it is the first occurrence of the decoded parameter name.
Successful exploitation allows an unauthenticated remote attacker to perform a full account takeover of any federated user by impersonating their identity in the SAML assertion. This requires the attacker to have their own account at the external Identity Provider to capture a validly signed redirect-binding message (such as a logout response) to use in the bypass.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━