Keycloak: account takeover through SAML broker redirect-parameter split (no CVE yet)
Severity: high · Patch status: unpatched · Since 2026-11-03
On 3 Nov 2026 Abraxas Labs published a lab-tested proof of concept for an unauthenticated account takeover in Keycloak's SAML identity-broker HTTP-Redirect endpoint. The researcher reproduced it on 26.8.1. An attacker who holds one genuine signed HTTP-Redirect response from a SAML identity provider that the realm trusts adds a forged SAMLResponse under a percent-encoded parameter name (SAML%52esponse). The endpoint parameter binding decodes that name and takes the forged document, while the signature check rebuilds the query from raw names and still accepts the genuine signature. Keycloak then signs in as the NameID inside the forged assertion, or creates that user through first-broker-login. The preconditions are a broker with signature validation on and 'Want Assertions signed' off, which is the usual result of metadata import, and an IdP that signs HTTP-Redirect responses; POST-only IdPs never give the attacker a signed GET. We re-read the Keycloak source at tags 26.8.1 and 26.7.5 and found the same code shape in both, so earlier 26.x lines are plausible but untested. As of 4 Nov 2026 we found no CVE for this flaw in NVD, no Keycloak advisory or GHSA, no fix release (the newest tag is 26.8.1), no vendor statement, and no report of exploitation in the wild; the only public PoC is the researcher's loopback lab. Until a fix ships, turn on Want Assertions Signed for every SAML broker, make IdPs POST-only where HTTP-Redirect is not needed, and look for logins whose NameID does not match the IdP session.
What to do
- For every SAML identity-provider broker, turn on 'Want Assertions signed' (wantAssertionsSigned=true). Recheck brokers created by metadata import, which leaves it off. With it on, the forged unsigned document is rejected.
- If an IdP does not need HTTP-Redirect responses, make it POST-binding only on the IdP side.
- At the reverse proxy, reject GET requests to /realms/*/broker/*/endpoint whose query parameter names contain percent-encoding. Also reject any request carrying more than one SAMLResponse after decoding.
- Hunt for abuse: look for IDENTITY_PROVIDER_LOGIN and first-broker-login user creations where the brokered NameID doesn't match the IdP's own sign-in logs for that session. Also search access logs for 'SAML%' in broker endpoint queries.
- Watch the Keycloak security advisories for a CVE and fixed release, and upgrade when one ships.
Sources
All live incidents on Threat Watch
