Identity CVE · SAML
CVE-2023-6717Keycloak SAML POST-binding XSS via ACS URL
high
What broke
Keycloak's SAML POST-binding flow reflected the Assertion Consumer Service URL without encoding it. Script in that URL ran in the IdP origin. XSS on an IdP login page is a session-theft bug. Fixed in RHSA-2024:1868 with CVE-2023-6787.
Why it matters
Users trust the Keycloak origin. Stealing that session is every federated app. The ACS URL is attacker-influenced by design (it comes from the SP). It must never be reflected raw.
What to do
- Upgrade Keycloak. Confirm SAML clients still post to the real ACS after the fix.
- Put a strict CSP on the login theme if you terminate TLS at a proxy that can set one.
- Review custom login themes. They often reintroduce this class of reflection.
Sources
- NVD: CVE-2023-6717
- Red Hat RHSA-2024:1868
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.