Skip to content
fr Sign in
7.7 High

CVE-2024-8698 A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class

Description

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

Affected products and versions

Product Affected versions Fixed in
Red Hat Build of Keycloak Versions not published
Red Hat build of Keycloak 22 22 earliest → < 22-21 22-21
Red Hat build of Keycloak 24 24 earliest → < 24-17 24-17
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Show the 3 other branches
Product Affected versions Fixed in
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-54 7.6-54
Red Hat Single Sign-On 7.0 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Build of Keycloak

The 266 CVEs of Red Hat Build of Keycloak →
CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 High CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 High CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Medium CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High
Track this CVE