Keycloak SAML HTTP-Redirect Binding Signature Bypass

Executive Summary

This vulnerability is in Keycloak's SAML HTTP-Redirect binding implementation. The server processes percent-encoded parameter names like %53AMLResponse but the signature verification only checks literal names. An attacker can send a crafted unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Keycloak logs for SAML HTTP-Redirect binding requests with percent-encoded parameter names like %53AMLResponse. Check for discrepancies between processed and verified parameter names in the SAML redirect binding flow.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to impersonate any federated user and gain unauthorized access to their accounts and data. This could result in data breaches, unauthorized transactions, or full system compromise depending on the user's privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Keycloak versions may face compliance violations, data breach notifications, and potential regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak patch if available. If no patch exists, disable SAML HTTP-Redirect binding or restrict access to Keycloak instances until a fix is deployed. Monitor for unusual SAML requests or account takeover attempts.

Useful 0 Not Useful 0