Read the docs
TI-2026-85425 Aliases CVE-2026-117691GHSA-c85j-3hq2-q6wj

Keycloak SAML redirect binding accepts unsigned messages

Priority MEDIUM 47CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-347.

Summary

Red Hat build of Keycloak 26.6 is affected. The SAML HTTP-Redirect binding verifies signatures only against literal parameter names, so percent-encoded parameter names bypass the check (CWE-347). An unauthenticated remote attacker can submit a crafted unsigned SAML message that the server processes, leading to full account takeover of federated users.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Keycloak 26.6—26.6-25Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6.9-1Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6-26Patch availableCNA
Red HatRed Hat Build of Keycloak——No fix listedCNA
Red HatRed Hat Single Sign-On 7——Not affectedCNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-25 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6.9-1 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-26 Patch available CNA
  • Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:/a:redhat:build_keycloak:26.6::el926.6—Red Hat
cpe:/a:redhat:build_keycloak:——Red Hat
cpe:/a:redhat:red_hat_single_sign_on:77—Red Hat
  • cpe:/a:redhat:build_keycloak:26.6::el9 Versions 26.6 — ·Red Hat
  • cpe:/a:redhat:build_keycloak: Versions — — ·Red Hat
  • cpe:/a:redhat:red_hat_single_sign_on:7 Versions 7 — ·Red Hat

Remediation

Red Hat build of Keycloak 26.6 is fixed in versions 26.6-25, 26.6-26 and 26.6.9-1, see RHSA-2026:96039 and RHSA-2026:96040. The sources list no fixed version for Red Hat Build of Keycloak.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Red Hat 2 advisories

  • RHSA-2026:96039 Released 2026-11-07 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.9 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:96040 Released 2026-11-07 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.9 Security Update
    • Red Hat build of Keycloak 26.6.9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Keycloak 26.6Fixed RHSA-2026:96039
Red Hat build of Keycloak 26.6.9Fixed RHSA-2026:96040
Not affected: 1 product
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-117691
  2. 2026-11-05 Alias added: GHSA-c85j-3hq2-q6wj
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Affected versions changed · Red Hat
  5. 2026-11-05 CVSS score added · Red Hat
  6. 2026-11-07 Fix available: [email protected], [email protected], [email protected] · CNA
  7. 2026-11-07 1 new reference · CNA
  8. 2026-11-07 Fix available: RHSA-2026:96039 · Red Hat
  9. 2026-11-07 Fix available: RHSA-2026:96040 · Red Hat
  10. 2026-11-07 Fix available: Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.9 · Red Hat

References

Advisory 1

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences