CVE-2024-8698: Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
Description revised (poc_count, poc_public, poc_url). The record changed; nothing in the observed threat did.
CVE record, CISA KEV and EPSS as of 2026-10-18.
CVEs like this one computed, by meaning
What to do now held facts and links
- Upgrade to 25.0.5 or later CVE record
- Later advisories still cover the fixes above and name higher ones: keycloak-saml-core 26.5.4 (CVE-2026-2575), 26.6.2 (CVE-2026-7307) OSV advisories
- Record your decision, dated and frozen with today's evidence: patch by a date · mitigated by a compensating control · deferred · accepted the risk · not affected
- Check your version against the ranges this record publishes.
What it is stated by the CNA
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.
- weakness
- CWE-347 Improper Verification of Cryptographic Signature
- affected
- Red Hat Build of Keycloak; Red Hat build of Keycloak 22; Red Hat build of Keycloak 24; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9; Red Hat Single Sign-On 7; Red Hat Single Sign-On 7.6 for RHEL 7; Red Hat Single Sign-On 7.6 for RHEL 8; Red Hat Single Sign-On 7.6 for RHEL 9; Red Hat RHEL-8 based Middleware Containers
- versions
- No affected-version range in held sources.
- fixed in
- 25.0.5
- fixed by package (from OSV advisories)
- org.keycloak:keycloak-saml-core (Maven): 22.0.13; 24.0.8; 25.0.6 GHSA-xgfv-xpx8-qhcr
- later fixes (from OSV advisories)
- keycloak-saml-core 22.0.13 is inside a range CVE-2026-2575 (GHSA-xv6h-r36f-3gp5) lists as affected. That advisory is fixed in 26.5.4.keycloak-saml-core 22.0.13 is inside a range CVE-2026-7307 (GHSA-p5mv-gj8j-xqgf) lists as affected. That advisory is fixed in 26.6.2.keycloak-saml-core 24.0.8 is inside a range CVE-2026-2575 (GHSA-xv6h-r36f-3gp5) lists as affected. That advisory is fixed in 26.5.4.keycloak-saml-core 24.0.8 is inside a range CVE-2026-7307 (GHSA-p5mv-gj8j-xqgf) lists as affected. That advisory is fixed in 26.6.2.keycloak-saml-core 25.0.6 is inside a range CVE-2026-2575 (GHSA-xv6h-r36f-3gp5) lists as affected. That advisory is fixed in 26.5.4.keycloak-saml-core 25.0.6 is inside a range CVE-2026-7307 (GHSA-p5mv-gj8j-xqgf) lists as affected. That advisory is fixed in 26.6.2.
- severity
- 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
- assigned by
- redhat
- published
- 2024-09-19
check us access.redhat.com access.redhat.com access.redhat.com access.redhat.com
Exploit code held, dated
- exploit code
- 1 public proof-of-concept repository, first seen 2024-10-10 (PoC-in-GitHub).
What moved held, dated
| date | EPSS | event |
|---|---|---|
| 20 Sep 2024 | 0.00092 | |
| 11 Oct 2024 | 0.00125 | |
| 19 Oct 2024 | 0.00896 | |
| 29 Oct 2024 | 0.01237 | |
| 17 Mar 2025 | 0.29397 | crossed 0.10 · scoring model v2025.03.14 |
| 15 Apr 2025 | 0.76172 | crossed 0.50 |
| 18 Nov 2025 | 0.29397 | crossed 0.50 |
| 21 Nov 2025 | 0.80968 | crossed 0.50 |
| 18 Apr 2026 | 0.81263 | |
| 20 May 2026 | 0.82215 | |
| 15 Jun 2026 | 0.02043 | crossed 0.10, crossed 0.50 · scoring model v2026.06.15 |
| 26 Jun 2026 | 0.0203 |
37 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.
Outside the record researched, cited
This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.
What would change this brief held, dated
- CISA KEV
- Not listed in the catalogue we hold. A listing changes this brief.
- exploit probability
- 0.02 on 2026-06-26 (FIRST's EPSS, a probability and not evidence of exploitation). Next band line: 10% (0.10). Crossing a line changes this brief.
- fix
- Held: 25.0.5. A newer fix from the CNA or OSV changes this brief.
How to check this
Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:
SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2024-8698', '2026-10-29T23:59:59.999999Z', now());