Patch Ticker

Keycloak SAML adapter skips issuer check, allowing login as other users

Attackers can get into the login server as other people and gain admin power.

Summary

The SAML adapter in Keycloak does not verify the issuer of a signed login assertion. An attacker who controls one identity provider sharing the same signing key can log in as any user, potentially gaining full administrative control.

Affected when

  • multiple identity providers share the same trusted signing key
  • applications using SAML-based authentication

What to do

Update to 26.4.17 for the 26.4 line or 26.6.8 for the 26.6 line. Back up your installation before updating.

Update to at least the version for your product:

  • Red Hat build of Keycloak 26.4 26.4.17 or later
  • Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

  • Linux
  • Red Hat AMQ Broker 7
  • Red Hat build of Keycloak 26.4
  • Red Hat build of Keycloak 26.4.17
  • Red Hat build of Keycloak 26.6
  • Red Hat build of Keycloak 26.6.8
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7

CVE IDs

Sources

Times

First published

First seen