CVE-2019-10201: Improper Authentication

August 14, 2019 (updated October 9, 2019)

It was found that Keycloak’s SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201
nvd.nist.gov/vuln/detail/CVE-2019-10201

Code Behaviors & Features

Detect and mitigate CVE-2019-10201 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →