Red Hat build of Keycloak SAML redirect binding signature bypass (account takeover)
Login servers linked to outside accounts can have user accounts taken!
Summary
Keycloak's SAML HTTP-Redirect binding processes percent-encoded parameter names while signature checks only match literal names, so signatures can be bypassed. An unauthenticated attacker can send an unsigned SAML message and take over accounts of federated users.
Affected when
- SAML HTTP-Redirect binding in use
What to do
Update to Red Hat build of Keycloak 26.6.9.
Products and platforms
CVE IDs
Sources
Times
First published
First seen