CVE-2026-18217

Description

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker-s parameters. This can cause some service providers to process the attacker-s data instead of the real login information, potentially leading to a user being logged into the wrong account.