A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
This critical vulnerability in Keycloak's SAML HTTP-Redirect binding exploits a signature validation bypass through percent-encoding manipulation. An attacker can submit unsigned or maliciously crafted SAML responses using encoded parameter names (e.g., %53AMLResponse instead of SAMLResponse) that bypass signature verification while still being processed by the application logic. This allows complete account takeover of federated users who rely on Keycloak for identity management, making it particularly dangerous for enterprises using SAML-based single sign-on across multiple applications.
While Casky's current skill library doesn't include specific detection rules mapped to this CVE, practitioners using Claude AI with extended reasoning can identify this attack pattern by analyzing authentication flow anomalies and SAML assertion handling. Security teams should focus on detecting unusual parameter encoding in SAML requests, mismatches between signed and processed parameter names, and unauthorized authentication events from federated identity providers. By examining web application logs for percent-encoded SAML parameters and cross-referencing with signature validation failures, practitioners can uncover exploitation attempts before account compromise occurs. Organizations should prioritize patching Keycloak instances and implementing strict SAML parameter validation that normalizes encoding before signature verification.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-117691. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation