CVE-2026-117691
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An…
- CVSS
- 9.1 Critical
- EPSS
- 0.3%
- Percentile
- 21
- Published
- 2026-11-05
- Force
- 6 of 12
- Public PoC
- 1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N