CVE-2026-18217: Keycloak SAML Auth Bypass Vulnerability

CVE-2026-18217 Overview

CVE-2026-18217 is an input validation flaw [CWE-20] in the Security Assertion Markup Language (SAML) protocol implementation of Keycloak, an open-source identity and access management solution. The vulnerability affects the HTTP-Redirect binding used for SAML authentication requests. When a client is configured with a wildcard redirect URL, an attacker can craft a request containing malicious parameters. Keycloak appends its legitimate authentication response to the attacker-controlled parameters. Some service providers then process the attacker's data instead of the real login information, which can log a user into the wrong account.

Critical Impact
Successful exploitation can cause a legitimate user to be authenticated into an attacker-controlled account context on service providers that mis-parse the response, undermining SAML trust.

Affected Products

Keycloak (SAML protocol implementation, HTTP-Redirect binding)
Red Hat build of Keycloak
Red Hat Single Sign-On downstream distributions

Discovery Timeline

2026-07-31 - CVE-2026-18217 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in the NVD database

Technical Details for CVE-2026-18217

Vulnerability Analysis

The flaw resides in how Keycloak constructs SAML responses when a client uses the HTTP-Redirect binding together with a wildcard redirect URL. The HTTP-Redirect binding encodes SAML messages as URL query parameters. Keycloak appends its own SAMLResponse, RelayState, and signature parameters to the redirect URL after a user authenticates. If that URL already contains attacker-supplied query parameters matching SAML parameter names, the resulting URL contains duplicate parameters. Service providers that read the first occurrence of each parameter, rather than the last, will process attacker-controlled values instead of Keycloak's legitimate response. The attacker can therefore inject a chosen SAMLResponse while still triggering a real authentication event at the identity provider.

Root Cause

The root cause is improper input validation of client redirect URIs combined with unsafe parameter concatenation. Wildcard redirect URLs allow query strings the identity provider does not sanitize. Keycloak appends response parameters without ensuring uniqueness or stripping conflicting attacker-provided parameters.

Attack Vector

Exploitation is network-based but requires user interaction and high attack complexity. The attacker needs a target Keycloak client configured with a wildcard redirect URL. The attacker crafts an authentication request URL that already contains a malicious SAMLResponse parameter and induces the victim to complete authentication. Keycloak appends its legitimate response, and the vulnerable service provider consumes the attacker's parameter first.

No verified public exploit code is available. See the Red Hat CVE-2026-18217 Advisory and Red Hat Bugzilla #2508311 for authoritative technical details.

Detection Methods for CVE-2026-18217

Indicators of Compromise

SAML authentication redirect URLs containing duplicate SAMLResponse, RelayState, or SigAlg query parameters.
Keycloak client configurations that use wildcard characters in the Valid Redirect URIs field.
Authentication events where the user identity asserted by the service provider does not match the Keycloak session subject.

Detection Strategies

Audit Keycloak realm and client exports for wildcard redirect URIs and flag any client using the HTTP-Redirect SAML binding.
Parse Keycloak access logs for authentication request URIs containing SAMLResponse or RelayState supplied on the inbound request rather than generated by Keycloak.
Correlate identity provider session IDs with service provider session subjects to detect authentication context mismatches.

Monitoring Recommendations

Forward Keycloak keycloak.log and service provider SAML assertion logs to a centralized analytics platform for cross-correlation.
Alert on any SAML redirect URL containing duplicate SAML protocol parameter names.
Track configuration changes to Keycloak clients and generate alerts when a client is set to allow wildcard redirect URIs.

How to Mitigate CVE-2026-18217

Immediate Actions Required

Inventory all Keycloak clients and remove wildcard characters from the Valid Redirect URIs field, replacing them with fully qualified URLs.
Prefer the SAML HTTP-POST binding over HTTP-Redirect for clients that support it, since POST bodies are not subject to the same parameter concatenation issue.
Apply the Keycloak security update referenced in the Red Hat CVE-2026-18217 Advisory as soon as it is available for your distribution.

Patch Information

Refer to the Red Hat CVE-2026-18217 Advisory and Red Hat Bugzilla #2508311 for current fixed package versions across Red Hat build of Keycloak and Red Hat Single Sign-On. Upstream Keycloak users should track the corresponding Keycloak project release notes and upgrade to the fixed minor version.

Workarounds

Restrict SAML clients to explicit redirect URIs and disable wildcard patterns entirely.
Enforce signed SAML requests and require signature validation on both AuthnRequest and Response messages.
Configure service providers to read the last occurrence of duplicate SAML parameters, or to reject responses whose URLs contain duplicate SAML parameter names.

bash

# Example: replace a wildcard redirect URI with explicit URIs via kcadm
kcadm.sh update clients/<CLIENT_UUID> -r <REALM> \
  -s 'redirectUris=["https://app.example.com/saml/acs"]' \
  -s 'attributes."saml.force.post.binding"="true"'