Search for vulnerabilities
Vulnerability details: VCID-pdcw-p5d6-ubgd
Vulnerability ID VCID-pdcw-p5d6-ubgd
Aliases GHSA-4xx7-2cx3-x473
Summary Duplicate Advisory: Keycloak SAML signature validation flaw # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xgfv-xpx8-qhcr. This link is maintained to preserve external references. # Original Description A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.
Status Published
Exploitability 0.5
Weighted Severity 6.9
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-347 Improper Verification of Cryptographic Signature
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6878
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6878
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6879
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6879
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6880
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6880
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6882
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6882
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6886
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6886
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6887
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6887
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6888
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6888
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6889
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6889
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:6890
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6890
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:8823
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:8823
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:8824
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:8824
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:8826
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:8826
cvssv3.1 7.7 https://access.redhat.com/security/cve/CVE-2024-8698
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2024-8698
cvssv3.1 7.7 https://bugzilla.redhat.com/show_bug.cgi?id=2311641
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2311641
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-4xx7-2cx3-x473
cvssv3.1 7.7 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 7.7 https://github.com/keycloak/keycloak/releases/tag/25.0.6
generic_textual MODERATE https://github.com/keycloak/keycloak/releases/tag/25.0.6
cvssv3.1 7.7 https://nvd.nist.gov/vuln/detail/CVE-2024-8698
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-8698
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2024:6878
https://access.redhat.com/errata/RHSA-2024:6879
https://access.redhat.com/errata/RHSA-2024:6880
https://access.redhat.com/errata/RHSA-2024:6882
https://access.redhat.com/errata/RHSA-2024:6886
https://access.redhat.com/errata/RHSA-2024:6887
https://access.redhat.com/errata/RHSA-2024:6888
https://access.redhat.com/errata/RHSA-2024:6889
https://access.redhat.com/errata/RHSA-2024:6890
https://access.redhat.com/errata/RHSA-2024:8823
https://access.redhat.com/errata/RHSA-2024:8824
https://access.redhat.com/errata/RHSA-2024:8826
https://access.redhat.com/security/cve/CVE-2024-8698
https://bugzilla.redhat.com/show_bug.cgi?id=2311641
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/releases/tag/25.0.6
https://nvd.nist.gov/vuln/detail/CVE-2024-8698
GHSA-4xx7-2cx3-x473 https://github.com/advisories/GHSA-4xx7-2cx3-x473
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6878
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6879
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6880
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6882
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6886
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6887
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6888
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6889
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:6890
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:8823
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:8824
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:8826
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/security/cve/CVE-2024-8698
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://bugzilla.redhat.com/show_bug.cgi?id=2311641
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://github.com/keycloak/keycloak/releases/tag/25.0.6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-8698
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2025-07-31T08:31:10.550397+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-4xx7-2cx3-x473/GHSA-4xx7-2cx3-x473.json 37.0.0