CVE-2023-6717Keycloak SAML POST-binding XSS via ACS URL
What broke
Keycloak's SAML POST-binding flow reflected the Assertion Consumer Service URL without encoding it. Script in that URL ran in the IdP origin. XSS on an IdP login page is a session-theft bug. Fixed in RHSA-2024:1868 with CVE-2023-6787.
Why it matters
Users trust the Keycloak origin. Stealing that session is every federated app. The ACS URL is attacker-influenced by design (it comes from the SP). It must never be reflected raw.
What to do
- Upgrade Keycloak. Confirm SAML clients still post to the real ACS after the fix.
- Put a strict CSP on the login theme if you terminate TLS at a proxy that can set one.
- Review custom login themes. They often reintroduce this class of reflection.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
- NVD: CVE-2023-6717
- Red Hat RHSA-2024:1868
Related identity CVEs
Related on Start with Identity
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEKeycloak SAML broker assertion replay, session hijack
Keycloak's SAML broker accepted a replayed assertion and hijacked a user session. An authentication bypass on the broker edge. Patched in the 2026 Keycloak SAML
- CVEKeycloak SAML signature validation bypass
Keycloak's XMLSignatureUtil decided a SAML response was signed when it was not bound to the assertion later consumed. Impersonation and privilege escalation on
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
Technique
This CVE is an instance of Session cookie theft. A session cookie is a bearer credential that proves nothing beyond possession. Whoever copies it inherits the logged-in session, skipping the password and the MFA challenge that produced it.