Keycloak CVE-2026-117691: SAML HTTP-Redirect signature bypass via percent-encoded parameter names — upgrade to 26.8.2
- Who cares: any realm that brokers or consumes SAML over HTTP-Redirect (IdP or SP paths that hit the redirect binding).
- Do now: upgrade community Keycloak to 26.8.2 or later; for RHBK wait for / apply the Red Hat erratum and confirm the build string. Prefer POST binding where you can until every node is patched.
- Same release: 26.8.2 also closes a large set of other authn/OIDC/SAML issues (XSS on login, DCR claim gaps, SAML DoS, organization SSO takeover, and more) — do not cherry-pick only this CVE.
- Reporter credited by Red Hat: Mayssen Aidoudi (Think-it GmbH).
Sources: Keycloak 26.8.2 released (security fixes, Nov 5) · Red Hat: CVE-2026-117691 · CVE Program: CVE-2026-117691