{"id":"CVE-2024-8698","summary":"Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak","details":"A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.","aliases":["GHSA-xgfv-xpx8-qhcr"],"modified":"2026-10-22T10:33:48.331132463Z","published":"2024-09-19T15:48:18.464Z","database_specific":{"cwe_ids":["CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8698.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"22.0.13-1"},{"fixed":"22-18"},{"fixed":"22-21"},{"fixed":"24.0.8-1"},{"fixed":"24-17"},{"fixed":"24-17"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"},{"fixed":"1:2.0.0-2.redhat_00005.1.el8eap"},{"fixed":"0:1.8.0-2.redhat_00001.1.el8eap"},{"fixed":"0:2.2.0-2.redhat_00001.1.el8eap"},{"fixed":"0:1.16.1-2.redhat_00007.1.el8eap"},{"fixed":"0:3.2.2-28.redhat_2.1.el8eap"},{"fixed":"0:2.15.1-1.redhat_00001.1.el8eap"},{"fixed":"0:3.14.0-2.redhat_00006.1.el8eap"},{"fixed":"0:4.0.5-1.redhat_00001.1.el8eap"},{"fixed":"1:2.0.0-2.redhat_00005.1.el8eap"},{"fixed":"0:2.0.1-1.redhat_00002.1.el8eap"},{"fixed":"0:0.1.0-2.redhat_00010.1.el8eap"},{"fixed":"0:1.12.284-2.redhat_00002.1.el8eap"},{"fixed":"0:1.2.5-2.redhat_00001.1.el8eap"},{"fixed":"0:800.4.0-1.GA_redhat_00001.1.el8eap"},{"fixed":"0:2.1.0-4.redhat_00001.1.el8eap"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el8eap"},{"fixed":"0:8.0.1-3.Final_redhat_00001.1.el8eap"},{"fixed":"0:0.8.1-2.redhat_00001.1.el8eap"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"},{"fixed":"0:3.0.1-1.redhat_00001.1.el8eap"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"},{"fixed":"0:3.5.3-1.Final_redhat_00001.1.el8eap"},{"fixed":"0:4.0.2-1.redhat_00001.1.el8eap"},{"fixed":"0:5.3.10-1.Final_redhat_00001.1.el8eap"},{"fixed":"0:2.22.1-1.redhat_00002.1.el8eap"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"},{"fixed":"0:9.37.3-1.redhat_00001.1.el8eap"},{"fixed":"0:9.6.0-1.redhat_00002.1.el8eap"},{"fixed":"0:2.3.0-1.redhat_00001.1.el8eap"},{"fixed":"0:2.0.1-3.Final_redhat_00001.1.el8eap"},{"fixed":"0:3.0.1-2.Final_redhat_00001.1.el8eap"},{"fixed":"0:3.0.4-1.redhat_00001.1.el8eap"},{"fixed":"0:8.0.0-6.redhat_00001.1.el8eap"},{"fixed":"0:2.0.16-1.redhat_00001.1.el8eap"},{"fixed":"0:2.2.0-1.redhat_00001.1.el8eap"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el8eap"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"},{"fixed":"1:2.0.0-2.redhat_00005.1.el9eap"},{"fixed":"0:1.8.0-2.redhat_00001.1.el9eap"},{"fixed":"0:2.2.0-2.redhat_00001.1.el9eap"},{"fixed":"0:1.16.1-2.redhat_00007.1.el9eap"},{"fixed":"0:3.2.2-28.redhat_2.1.el9eap"},{"fixed":"0:2.15.1-1.redhat_00001.1.el9eap"},{"fixed":"0:3.14.0-2.redhat_00006.1.el9eap"},{"fixed":"0:4.0.5-1.redhat_00001.1.el9eap"},{"fixed":"1:2.0.0-2.redhat_00005.1.el9eap"},{"fixed":"0:2.0.1-1.redhat_00002.1.el9eap"},{"fixed":"0:0.1.0-2.redhat_00010.1.el9eap"},{"fixed":"0:1.12.284-2.redhat_00002.1.el9eap"},{"fixed":"0:1.2.5-2.redhat_00001.1.el9eap"},{"fixed":"0:800.4.0-1.GA_redhat_00001.1.el9eap"},{"fixed":"0:2.1.0-4.redhat_00001.1.el9eap"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el9eap"},{"fixed":"0:8.0.1-3.Final_redhat_00001.1.el9eap"},{"fixed":"0:0.8.1-2.redhat_00001.1.el9eap"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"},{"fixed":"0:3.0.1-1.redhat_00001.1.el9eap"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"},{"fixed":"0:3.5.3-1.Final_redhat_00001.1.el9eap"},{"fixed":"0:4.0.2-1.redhat_00001.1.el9eap"},{"fixed":"0:5.3.10-1.Final_redhat_00001.1.el9eap"},{"fixed":"0:2.22.1-1.redhat_00002.1.el9eap"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"},{"fixed":"0:9.37.3-1.redhat_00001.1.el9eap"},{"fixed":"0:9.6.0-1.redhat_00002.1.el9eap"},{"fixed":"0:2.3.0-1.redhat_00001.1.el9eap"},{"fixed":"0:2.0.1-3.Final_redhat_00001.1.el9eap"},{"fixed":"0:3.0.1-2.Final_redhat_00001.1.el9eap"},{"fixed":"0:3.0.4-1.redhat_00001.1.el9eap"},{"fixed":"0:8.0.0-6.redhat_00001.1.el9eap"},{"fixed":"0:2.0.16-1.redhat_00001.1.el9eap"},{"fixed":"0:2.2.0-1.redhat_00001.1.el9eap"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el9eap"},{"fixed":"0:18.0.18-1.redhat_00001.1.el7sso"},{"fixed":"0:18.0.18-1.redhat_00001.1.el8sso"},{"fixed":"0:18.0.18-1.redhat_00001.1.el9sso"},{"fixed":"7.6-54"}],"source":"AFFECTED_FIELD","strategy":"InverseAffectedRanges"}]}],"cna_assigner":"redhat"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6878"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6879"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6880"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6882"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6886"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6887"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6888"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6889"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6890"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8823"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8824"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8826"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-8698"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8698.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8698"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2311641"},{"type":"PACKAGE","url":"https://github.com/keycloak/keycloak"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/keycloak/keycloak","events":[{"introduced":"0"},{"fixed":"d1748888dfab652a1fe5a9a4544ecf8c5e59820a"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"25.0.5"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["2.4.0.Test","1.3.0.Final","1.1.0.Beta2","1.0.0.Final","1.0-final","1.0-rc-1","1.0-beta-4","1.0-beta-2","1.0-beta-1","1.0-alpha-3","1.0-alpha-2","1.0-alpha-1","1.0-alpha-1-12062013"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-8698.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L"}]}