CVE-2026-117691

{
  "etk_id": "ETK-2026-3628",
  "cve_id": "CVE-2026-117691",
  "display_id": "CVE-2026-117691",
  "ghsa_id": "GHSA-c85j-3hq2-q6wj",
  "euvd_id": "EUVD-2026-117441",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SAML Redirect signature validation bypass in Keycloak",
  "summary": "Keycloak deployments that process SAML HTTP-Redirect messages are affected by inconsistent handling of encoded parameter names during signature validation. An unauthenticated attacker may cause an unsigned SAML message to be accepted, potentially taking over federated user accounts.",
  "mitigation": "Disable SAML HTTP-Redirect handling where feasible, or limit SAML endpoint access to trusted identity-provider paths. Monitor Red Hat updates and apply a vendor-provided fixed release when one is published.",
  "vendor": "Red Hat",
  "product": "Red Hat Build of Keycloak",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "keycloak-services",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "rhbk/keycloak-rhel9",
      "purl": null
    }
  ],
  "cwes": [
    347
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 24.532292233333333,
  "t0_at": "2026-11-05T13:27:23.748000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T13:27:23.748000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T13:27:23.748000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117691"
    }
  }
}