8.1
High
CVE-2019-10201 It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures
Description
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak | Versions not published |
Other CVEs of keycloak
The 22 CVEs of keycloak →
CVE-2020-14366
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible…
6.8
Medium
CVE-2020-1758
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while…
5.3
Medium
CVE-2020-1714
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without…
7.5
High
CVE-2020-1718
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0
7.1
High