Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-120984 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-07 |
| Vendor | Red Hat |
| Product | Keycloak |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Two critical vulnerabilities in Keycloak — an identity and access management (IAM/SSO) server developed as an open source project and distributed by Red Hat as Red Hat build of Keycloak:
- CVE-2026-120984 (CVSS 9.1) — a flaw in the Keycloak server’s client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. An authenticated attacker with client management permissions (manage-clients) can bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.
- CVE-2026-117691 (CVSS 9.1) — a flaw in the SAML HTTP-Redirect binding implementation. The server processes percent-encoded parameter names (such as %53AMLResponse), while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users. No authentication is required.
Required Actions
- CVE-2026-117691: upgrade Keycloak to 26.8.2 (community release of November 5, 2026) and Red Hat build of Keycloak to 26.6.9 (advisories RHSA-2026:96039 and RHSA-2026:96040). According to Red Hat, Red Hat Single Sign-On 7 is not affected by this flaw.
- CVE-2026-120984: as of this alert, Red Hat lists Red Hat build of Keycloak and Red Hat Single Sign-On 7 as affected and has not yet named a fixed version or an official mitigation. Track the CVE page on the Red Hat Customer Portal. Until a fix is available, limit the manage-clients role to a minimal group of trusted administrators, review clients with authorization services enabled and any existing JavaScript policies, and monitor admin events for client creation and import.
- If you use SAML federation (Keycloak as an identity broker), review federated login logs for unusual sessions after upgrading.
Who Is Affected?
The vulnerabilities affect organizations using Keycloak (community releases) and Red Hat build of Keycloak by Red Hat as a central single sign-on (SSO) system for internal applications, customer portals and APIs. CVE-2026-120984 also affects Red Hat Single Sign-On 7. CVE-2026-117691 matters especially where Keycloak accepts logins from external SAML identity providers using the HTTP-Redirect binding. Also check products and platforms that ship Keycloak as an embedded component.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
