CVE-2019-10201

Published: Aug 14, 2019Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

Affected (3)

Products: Redhat: Keycloak, Single Sign On

2 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Keycloak	Up to 6.0.1
Redhat Single Sign On	Version 7.0
Redhat Single Sign On	Version 7.3.3

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

DEPRECATED: Authentication Bypass Issues

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201

Source: secalert@redhat.com

Issue TrackingMitigationVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMitigationVendor Advisory

Timeline

No history available yet.