Read the docs
TI-2019-07522 Aliases CVE-2019-10201GHSA-4fgq-gq9g-3rw7

Improper signature verification in Red Hat keycloak

Priority LOW 36CWE-592Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

Why it matters now

EPSS 0.00714 53rd percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-core (Maven): 7.0.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatkeycloakup to keycloak 6.0.1—No fix listedCNA
—org.keycloak:keycloak-core (Maven)before 7.0.07.0.0Patch availableGHSA-4fgq-gq9g-3rw7
  • keycloak VendorRed Hat Affected up to keycloak 6.0.1 Fixed in — No fix listed CNA
  • org.keycloak:keycloak-core (Maven) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-4fgq-gq9g-3rw7

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*up to 6.0.1VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.3.3:*:*:*:*:*:*:*7.3.3VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions up to 6.0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.3.3:*:*:*:*:*:*:* Versions 7.3.3 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-4fgq-gq9g-3rw7 org.keycloak:keycloak-core (Maven) Fixed in 7.0.0 Advisory →

Red Hat 3 advisories

  • RHSA-2020:2366 Released 2020-06-04 · Red Hat rating Important
    Red Hat support for Spring Boot 2.1.12 security and bug fix update
    • Red Hat Runtimes Spring Boot 2.1.12
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2019:2483 Released 2019-08-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.3 security update
    • Red Hat Single Sign-On 7.3.3 zip

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat Runtimes Spring Boot 2.1.12Fixed RHSA-2020:2366
Red Hat Single Sign-On 7.3.3 zipFixed RHSA-2019:2483
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 1 product
  • Red Hat Mobile Application Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10201
  2. 2026-10-03 Alias added: GHSA-4fgq-gq9g-3rw7

References

Advisory 2

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences