VYPR
← All advisories
High severity8.1NVD Advisory· Published Aug 14, 2019· Updated Jun 17, 2026

CVE-2019-10201

CVE-2019-10201

Description

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-coreMaven
< 7.0.07.0.0

Affected products

5
  • Red Hat/Keycloak2 versions
    cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*range: <=6.0.1
    • (no CPE)range: up to keycloak 6.0.1
  • Red Hat/Single Sign On2 versions
    cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:single_sign-on:7.3.3:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.keycloak/keycloak-core
    Range: < 7.0.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.