Описание
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Отчет
The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for unauthenticated account takeover under common configuration scenarios. Successful exploitation allows an attacker to impersonate users and gain full access to their accounts by forging SAML responses. The vulnerability's root cause is an improper configuration of signature validation settings during the SAML IdP metadata import process.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Data Grid 8 | keycloak-services | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | keycloak-services | Not affected | ||
| Red Hat Single Sign-On 7 | keycloak-services | Not affected | ||
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2026:50847 | 05.08.2026 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9 | Fixed | RHSA-2026:50847 | 05.08.2026 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2026:50847 | 05.08.2026 |
| Red Hat build of Keycloak 26.4.14 | keycloak-services | Fixed | RHSA-2026:50846 | 05.08.2026 |
| Red Hat build of Keycloak 26.4.14 | rhbk-openshift-rhel9/rhbk-openshift-rhel9 | Fixed | RHSA-2026:50846 | 05.08.2026 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2026:50849 | 05.08.2026 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9 | Fixed | RHSA-2026:50849 | 05.08.2026 |
Показывать по
Дополнительная информация
Статус:
7.4 High
CVSS3
Связанные уязвимости
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
A flaw was found in the SAML metadata import functionality of the keyc ...
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
7.4 High
CVSS3