GHSA-4xx7-2cx3-x473: keycloak-saml-core fixed in 25.0.6

GHSA-4xx7-2cx3-x473 PUBLISHED CVSS 7.699999809265137 HIGH

Duplicate Advisory: Keycloak SAML signature validation flaw

Record from GitHub Advisory Database · Published September 19, 2024

keycloak-saml-core is fixed in 25.0.6 (Maven Central)

Duplicate Advisory: Keycloak SAML signature validation flaw

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
org.keycloak:keycloak-saml-core	Maven Central	25.0.6
keycloak	Wolfi	25.0.6-r0
keycloak	Chainguard	25.0.6-r0

Risk scores

CVSS 3.1

7.699999809265137

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Affected products

Vendor	Product	Versions
Maven	org.keycloak:keycloak-saml-core	0
wolfi	keycloak	0
chainguard	keycloak	0

Timeline

Sep 19, 2024 CVE Published
Dec 20, 2024 CVE Rejected
Dec 20, 2024 CVE Updated
Mar 17, 2026 Distribution Patch (12 in total, the first dated here)
Mar 17, 2026 Security Advisory (13 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-4xx7-2cx3-x473
vulnetix vdb fixes GHSA-4xx7-2cx3-x473

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-4xx7-2cx3-x473/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →