Vulnerability in Keycloak

Classification: Important, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 7.4, CVEs: , Summary: Keycloak 26.8.1 High 7.4 Remote SAML broker leftover. A person with no Keycloak account can finish login as someone else by splitting the signed HTTP-Redirect query. Needs a redirect-signing IdP with validateSignature on and wantAssertionsSigned off.