---
title: Keycloak CVE-2026-117691: SAML HTTP-Redirect signature bypass via percent-encoded parameter names — upgrade to 26.8.2 | ctxsec
url: https://ctxsec.com/items/keycloak-cve-2026-117691-saml-redirect-signature-bypass-26-8-2
description: "Keycloak 26.8.2 ships a fix for CVE-2026-117691: the SAML HTTP-Redirect binding verifies signatures against literal query parameter names, while message processing accepts percent-encoded names such as %53AMLResponse. An attacker who can place a crafted unsigned SAML parameter ahead of a legitimately signed one can get the server to process the unsigned message, enabling full account takeover of federated users (Red Hat CVSS 9.1, network / no privileges / no user interaction). Community Keycloak: move to 26.8.2+. Red Hat Build of Keycloak was still listed affected with no erratum on the Red Hat CVE page when we checked Nov 6; treat RHBK as open until your advisory clears."
status: "official (Keycloak 26.8.2 release notes Nov 5; Red Hat CVE-2026-117691 Important / CVSS 9.1; GHSA-c85j-3hq2-q6wj); not in CISA KEV as of this writing"
published: 2026-11-06
---

> Keycloak 26.8.2 ships a fix for CVE-2026-117691: the SAML HTTP-Redirect binding verifies signatures against literal query parameter names, while message processing accepts percent-encoded names such as %53AMLResponse. An attacker who can place a crafted unsigned SAML parameter ahead of a legitimately signed one can get the server to process the unsigned message, enabling full account takeover of federated users (Red Hat CVSS 9.1, network / no privileges / no user interaction). Community Keycloak: move to 26.8.2+. Red Hat Build of Keycloak was still listed affected with no erratum on the Red Hat CVE page when we checked Nov 6; treat RHBK as open until your advisory clears.

[← Cybersecurity News](/news) · [markdown](/items/keycloak-cve-2026-117691-saml-redirect-signature-bypass-26-8-2.md)

official (Keycloak 26.8.2 release notes Nov 5; Red Hat CVE-2026-117691 Important / CVSS 9.1; GHSA-c85j-3hq2-q6wj); not in CISA KEV as of this writing

2026-11-06

### Keycloak CVE-2026-117691: SAML HTTP-Redirect signature bypass via percent-encoded parameter names — upgrade to 26.8.2

- **Who cares:** any realm that brokers or consumes SAML over HTTP-Redirect (IdP or SP paths that hit the redirect binding).
- **Do now:** upgrade community Keycloak to **26.8.2** or later; for RHBK wait for / apply the Red Hat erratum and confirm the build string. Prefer POST binding where you can until every node is patched.
- **Same release:** 26.8.2 also closes a large set of other authn/OIDC/SAML issues (XSS on login, DCR claim gaps, SAML DoS, organization SSO takeover, and more) — do not cherry-pick only this CVE.
- Reporter credited by Red Hat: Mayssen Aidoudi (Think-it GmbH).

Sources: [Keycloak 26.8.2 released (security fixes, Nov 5)](https://www.keycloak.org/2026/11/keycloak-2682-released) · [Red Hat: CVE-2026-117691](https://access.redhat.com/security/cve/cve-2026-117691) · [CVE Program: CVE-2026-117691](https://www.cve.org/CVERecord?id=CVE-2026-117691)