CVE-2019-10201: Improper Verification of Cryptographic Signature in keycloak-core
Summary
CVE-2019-10201: Improper Verification of Cryptographic Signature in keycloak. Affects org.keycloak:keycloak-core versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows users to authenticate and authorize applications. The keycloak-core package is a core component of Keycloak, providing essential functionality for user management and security. This vulnerability affects versions up to 6.0.1 of the keycloak-core package.
Vulnerability Detail
The vulnerability in keycloak-core arises from the improper verification of cryptographic signatures in the SAML broker. When processing SAML Responses, Keycloak fails to verify missing message signatures. This allows an attacker to modify the SAML Response by removing the <Signature> sections, while still being accepted by the system. As a result, the attacker can impersonate other users and potentially gain unauthorized access to sensitive information.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the keycloak-core package.
Conclusion
In conclusion, the keycloak-core package up to version 6.0.1 is vulnerable to an improper verification of cryptographic signature vulnerability in the SAML broker. This can lead to unauthorized access and impersonation of users. It is recommended to upgrade to version 7.0.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications.
The SAML broker in Keycloak allows users to integrate SAML-based identity providers with Keycloak, enabling single sign-on functionality.
This vulnerability allows an attacker to impersonate other users and potentially gain unauthorized access to sensitive information.
Yes, upgrading to version 7.0.0 or later of the keycloak-core package fixes this vulnerability.
No, there are no known workarounds. It is crucial to update to the fixed version of the keycloak-core package.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
