CVE-2026-117691CVSS 9.1SAML HTTP-Redirect signature bypass
Message processing accepts encoded parameter names while signature verification checks literal names. Red Hat supplies a draft CVSS 3.1 score of 9.1.
Keycloak SAML redirect signature bypass permits federated-account takeover
Keycloak processes percent-encoded SAML parameter names that its signature checker overlooks, allowing unsigned messages to take over federated accounts. Upstream 26.8.2 includes the fix. Red Hat Build of Keycloak is affected, but its reviewed record supplies no fixed build; Red Hat Single Sign-On 7 is listed unaffected.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- CVSS 9.1
- 1 CVE tracked here
- Splash zone
- Affected Keycloak SAML HTTP-Redirect identity-broker flows; an attacker needs network access, not an authenticated account.
- Keycloak · SAML · authentication
- In the wild
- Unknown
- The reviewed vendor records do not establish exploitation or a victim count.
What happened
The signature checker and SAML message processor disagree about encoded query-parameter names. A crafted unsigned message can consequently be processed in place of a signed message, giving access as a federated user and to that user’s roles/data. This is a network-reachable authentication bypass; an existing authenticated attacker account is not required. The reviewed originals do not establish the full vulnerable-version range, active exploitation or confirmed victims.
Keycloak lists this fix in the broader 26.8.2 release. This article covers the newly disclosed SAML root cause; that release also contains other security fixes with their own conditions. Red Hat rates this flaw Important and publishes a draft CVSS 3.1 score of 9.1. Its downstream product labels do not establish that an upstream artifact is a supported Red Hat replacement. L3 reflects a concrete identity-boundary failure in a mainstream identity server.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Upstream Keycloak | 26.8.2 | Release explicitly lists CVE-2026-117691 / issue 54714 |
Crime-scene timeline
Nov 5, 2026
Upstream release and Red Hat record disclose the SAML flaw
Keycloak 26.8.2 lists the fix; Red Hat describes unauthenticated federated-account takeover and distinguishes affected downstream products.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Keycloak original 26.8.2 releasePrimaryNovember 5 release lists issue 54714/CVE-2026-117691 and points to migration guidance.
- Red Hat original CVE dataPrimaryOriginal mechanism, draft 9.1 CVSS 3.1, affected Build of Keycloak, unaffected Single Sign-On 7 and no accepted mitigation.
- Keycloak issue APIPrimaryNovember 5 public issue names encoded-parameter signature bypass and broker login as any user; its body is empty.