VulnerabilityDeferred

CVE-2024-8698

This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

HIGH 7.7EPSS 2.03%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS: 2.03% probability · 81th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-347
Source: secalert@redhat.com

EPSS trend

EPSS 2.0% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.