A critical vulnerability exists in the SAML HTTP-Redirect binding implementation of Keycloak due to inconsistent processing of percent-encoded parameter names during signature verification. This flaw allows an attacker to bypass signature checks by using crafted, unsigned SAML messages, resulting in full account takeover of federated users.