Description
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | < 25.0.5 | 25.0.5 |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat build of Keycloak 22 | — | — |
| Red Hat | Red Hat build of Keycloak 24 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.18-1.redhat_00001.1.el7sso | RHSA-2024:6880, RHSA-2024:6879, RHSA-2024:6878 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.33.0-1.redhat_00015.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-aesh-extensions | 1.8.0-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-aesh-readline | 2.2.0-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-codec | 1.16.1-2.redhat_00007.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-collections | 3.2.2-28.redhat_2.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-io | 2.15.1-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-lang | 3.14.0-2.redhat_00006.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.5-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-artemis-native +2 | 1:2.0.0-2.redhat_00005.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-artemis-wildfly-integration | 2.0.1-1.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-asyncutil | 0.1.0-2.redhat_00010.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-aws-java-sdk +4 | 1.12.284-2.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-cryptacular | 1.2.5-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.4.0-1.GA_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-fastinfoset | 2.1.0-4.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.2.31-1.Final_redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-hibernate-validator +1 | 8.0.1-3.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-hppc | 0.8.1-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jakarta-servlet-jsp-jstl +1 | 3.0.1-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jboss-cert-helper +1 | 1.1.3-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.5.3-1.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.2-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jgroups | 5.3.10-1.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-log4j | 2.22.1-1.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-narayana +8 | 6.0.3-1.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-nimbus-jose-jwt | 9.37.3-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-objectweb-asm +1 | 9.6.0-1.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-pem-keystore | 2.3.0-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-resteasy-extensions +1 | 2.0.1-3.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-resteasy-spring | 3.0.1-2.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-saaj-impl | 3.0.4-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-shibboleth-java-support | 8.0.0-6.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.16-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-snakeyaml | 2.2.0-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.4-2.GA_redhat_00005.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
huydoppaz/CVE-2024-8698-POC ★ 6 · Oct 10, 2024
i'm noob with saml and keycloak . J4f
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Keycloak - SAML Core Package Signature Validation Flaw http/cves/2024/CVE-2024-8698.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-saml-core | < 22.0.13 | 22.0.13 | GHSA-xgfv-xpx8-qhcr |
| Maven | org.keycloak:keycloak-saml-core | >= 23.0.0, < 24.0.8 | 24.0.8 | GHSA-xgfv-xpx8-qhcr |
| Maven | org.keycloak:keycloak-saml-core | >= 25.0.0, < 25.0.6 | 25.0.6 | GHSA-xgfv-xpx8-qhcr |
Advisories 6
- RHSA-2024:8823 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:8824 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:6880 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:6878 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:6879 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2024-2190 Red Hat Single Sign On und Keycloak: Mehrere Schwachstellen ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · May 14, 2025
References
- RHSA-2024:6878 vendor-advisory
- RHSA-2024:6879 vendor-advisory
- RHSA-2024:6880 vendor-advisory
- RHSA-2024:6882 vendor-advisory
- RHSA-2024:6886 vendor-advisory
- RHSA-2024:6887 vendor-advisory
- RHSA-2024:6888 vendor-advisory
- RHSA-2024:6889 vendor-advisory
- RHSA-2024:6890 vendor-advisory
- RHSA-2024:8823 vendor-advisory
- RHSA-2024:8824 vendor-advisory
- RHSA-2024:8826 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-8698 vdb-entry
- RHBZ#2311641 issue-tracking