Low Severity
CVE-2026-117691
Published: Nov 9, 2026
Detection-only triage for CVE-2026-117691 (CVSS 9.1): Keycloak SAML HTTP-Redirect binding signature bypass, fixed in 26.8.2
# `keycloak-saml-scanner`
Local triage for `CVE-2026-117691` (`CVSS 9.1`), a signature bypass in `Keycloak`'s `SAML HTTP-Redirect` binding. Give it a `Keycloak` version you own, point it at an install directory, or point it at a `Keycloak` base `URL`, and it tells you whether that install is still open. It never sends a `SAML` message, never sends a crafted request, never logs in.
## `The flaw`
`CVE-2026-117691` is improper verification of cryptographic signature (`CWE-347`) in `Keycloak`'s `SAML HTTP-Redirect` binding. `Keycloak` processes percent-encoded query parameter names (`%53AMLResponse`) while its signature verification only checks literal parameter names. An unauthenticated attacker supplies a crafted, unsigned `SAML` message, placed before the legitimately signed one in the request, and the server acts on the unsigned message instead. The result is full account takeover of federated users: log in as any user, get their roles and data, no credentials, no user interaction.
Only `SAML` is exposed. A realm that brokers `SAML` identity providers, or serves a `SAML` client over the `HTTP-Redirect` binding, is in scope. `OIDC`-only realms are not. Use `--saml-usage no` if you know no `SAML` is in use: a vulnerable version then grades `NOT-EXPOSED` instead of `VULNERABLE`, and the version grade is still shown.
The fix is `Keycloak 26.8.2`, released `5 November 2026`. It is the only release carrying the fix, and it fixes `33 CVEs` in one release, including the `Brotli4j` dependency flaw `CVE-2026-111497` (graded separately by `node2shell-inventory-scanner`).
## `The traps: backports without the fix, and a dead line`
| `Signal` | `Grade` | `Why` |
| --- | --- | --- |
| `26.8.2` or newer | `PATCHED` | The only release carrying the fix |
| `26.8.0`, `26.8.1` | `VULNERABLE` | Fix only in `26.8.2`. `26.8.0` also carries the `;` separator variant fixed in `26.8.1`, so it has two bypasses in the same code path |
| `26.7.x` | `VULNERABLE` | End of life, no fix rele