CVE-2019-10201: red hat keycloak DEPRECATED: Authentication Bypass Issues
Vulnerability summary
CVE-2019-10201 is a high (CVSS 8.1) DEPRECATED: Authentication Bypass Issues vulnerability in red hat keycloak. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.7% of scored vulnerabilities.
Timeline
- 14-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.71% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat2 products
- keycloak≤ 6.0.1
- single_sign-on7.0 | 7.3.3
Org.keycloak1 product
- keycloak-core< 7.0.0
Red hat1 product
- keycloak≤ keycloak 6.0.1
3 vendors · 4 products
References
2 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201X Refsource CONFIRMIssue TrackingMitigationVendor AdvisoryWEB
