CVE-2026-117691, Keycloak SAML HTTP-Redirect signature bypass: a percent-encoded parameter name lets an unauthenticated attacker log in as any federated user; fixed in Keycloak 26.8.2

Keycloak 26.8.2, released on 2026-11-05, fixes CVE-2026-117691, a SAML redirect binding signature bypass via a percent-encoded parameter name (%53AMLResponse) that its release notes describe as broker login as any user (Keycloak, 2026-11-05). Red Hat, the CNA, explains that Keycloak's SAML HTTP-Redirect binding processes percent-encoded parameter names while the signature verification logic checks only literal ones, so an attacker can supply a crafted, unsigned SAML message that the server processes instead of a legitimately signed one; it scores the flaw CVSS 3.1 9.1 with no privileges or user interaction, rates it Important because it allows full account takeover of federated users, and says no available mitigation meets its criteria; it lists its build of Keycloak 26.6.9 packages as fixed by RHSA-2026:96040 and the 26.6 container images by RHSA-2026:96039, both released on 2026-11-07, and Red Hat Single Sign-On 7 as not affected (Red Hat, 2026-11-05). Its courtesy guidance describes the attack as a crafted request that places an encoded unsigned SAML parameter before a legitimately signed one, and suggests auditing and restricting account registration on external identity providers so attackers cannot capture legitimately signed redirect-binding messages (Red Hat, 2026-11-05).

The release fixes further issues tagged with CVE identifiers, among them an unauthenticated single-request JVM termination through a SAML 1.1 AuthorityBinding parser loop, labelled an incomplete fix of an earlier flaw (CVE-2026-110931), unauthenticated CPU and worker-pool exhaustion through the SAML 1.1 KeyInfo parser that needs a restart (CVE-2026-107602), unverified identity-provider email auto-linking that enables account takeover (CVE-2026-97175), an account takeover through an authentication race (CVE-2026-103112) and a SAML broker that accepts holder-of-key assertions without proof of key possession (CVE-2026-92855) (Keycloak, 2026-11-05). The release also fixes CVE-2026-111497, the out-of-bounds write in its bundled Brotli decoder (Keycloak, 2026-11-05), which CISA lists as exploited (CISA, 2026-10-27). No source reports exploitation of the SAML flaws or a public proof of concept; CISA's listing concerns the Brotli decoder.