Moderate severity vulnerability that affects org.keycloak:keycloak-core

2019-09-23T18:32:16
ID GHSA-4FGQ-GQ9G-3RW7
Type github
Reporter GitHub Advisory Database
Modified 2019-09-23T18:32:16

Description

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.