Start with Identity
Subscribe
Identity CVE · SAML

CVE-2024-8698Keycloak SAML signature validation bypass

high
Product: KeycloakVendor: Red HatCWE-347Disclosed: 2024-09-19Status: PatchedProtocol deep diveNVD ↗

What broke

Keycloak's XMLSignatureUtil SAML signature check returned the wrong answer. A crafted response could bypass validation, impersonate a user, and escalate privilege in any realm that accepted SAML. Red Hat rated it high and patched in September 2024 (RHSA train around RHSA-2024 and the Keycloak 25.x / 24.x fixes).

Why it matters

Keycloak is the default on-prem IdP for a lot of Kubernetes and Red Hat estates. A SAML verifier bug there is every federated app, not one SP. 2024 was the year ruby-saml, GHES, samlify, and Keycloak all failed the same signature-binding test.

What to do

  • Upgrade Keycloak off the September 2024 advisory. Confirm the running image, not the Helm chart default.
  • If the realm used SAML while unpatched, review first-time NameIDs and new realm-admin role mappings.
  • Pair with the 2025 Keycloak set (First Broker Login, password-reset AD skip) so you do not patch SAML and leave the other identity holes.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.