Description (CNA)
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / keycloak | affected up to keycloak 6.0.1 |
CWE
CWE-592
References
ADP enrichment
No English description supplied.