CVE-2019-10201: High severity red hat keycloak vulnerability
If an attacker modifies the SAML Response and removes the <Signature> Sections, the message is still accepted and the message can be modified, allowing the attacker to impersonate any user on the keycloak protected systems by modifying assertations.
Upstream Issue:
https://issues.jboss.org/browse/KEYCLOAK-10786
Other sources
It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-10201?
CVE-2019-10201 is a vulnerability in Keycloak's SAML broker that allows an attacker to modify SAML Response messages without detection.
How severe is CVE-2019-10201?
CVE-2019-10201 has a severity score of 8.1 out of 10, indicating a high-risk vulnerability.
What is the affected software?
The affected software is Keycloak versions up to 6.0.1.
How can an attacker exploit CVE-2019-10201?
An attacker can exploit CVE-2019-10201 by modifying SAML Response messages and removing the <Signature> sections without detection.
How can I fix CVE-2019-10201?
To fix CVE-2019-10201, update Keycloak to version 7.0.0 or higher.