CVE-2019-10201CWE-592

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures

High · published August 14, 2019

CVSS v3.0
8.1
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00714 · 53.1th percentile
Weakness
CWE-592 · DEPRECATED: Authentication Bypass Issues
Published
2019-08-14T16:09Z
EPSS history
Timeline
  • 14 AUG 16:09Z
    It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures
    cvelistv5