A signature bypass vulnerability was identified in Keycloak's SAML HTTP-Redirect binding. The root cause is a discrepancy between how the server parses query parameters for processing versus how it parses them for signature verification. Specifically, the server decodes percent-encoded parameter names (e.g., %53AMLResponse becomes SAMLResponse) during processing, but the signature verification logic re-parses the raw query string and only recognizes literal parameter names.
By sending a GET request where a crafted, unsigned SAMLResponse is placed first using a percent-encoded name, followed by a legitimately signed SAMLResponse, an attacker can bypass the signature check. The signature check validates the second (legitimate) message, but the server processes the first (crafted) message because it is the first occurrence of the decoded parameter name.
Successful exploitation allows an unauthenticated remote attacker to perform a full account takeover of any federated user by impersonating their identity in the SAML assertion. This requires the attacker to have their own account at the external Identity Provider to capture a validly signed redirect-binding message (such as a logout response) to use in the bypass.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━