LiveActive security incident?Get immediate response
CVE Record

CVE-2023-6717: Keycloak: xss via assertion consumer service url in saml post-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

MediumCVSS 6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-6717 is a Keycloak SAML configuration flaw. A highly privileged administrator or client with registration access could register a malicious ACS URL and cause JavaScript execution when a user submits the SAML form. This can affect confidentiality and integrity across realms or applications.

Executive priority

Treat this as a moderate-priority identity-platform issue. It is not presented as actively exploited, but Keycloak often protects many applications, so delegated administration and affected Red Hat packages should be reviewed promptly.

Technical view

The issue is CWE-79 XSS in SAML client registration for the POST binding flow. Keycloak could accept JavaScript URIs as Assertion Consumer Service POST Binding URLs. CVSS is 6.0 with network reachability, high attack complexity, high privileges, and required user interaction.

Likely exposure

Exposure is most relevant where Keycloak SAML client registration is delegated to realm administrators or clients. The bundle lists affected Red Hat build of Keycloak 22 packages, OpenShift Serverless 1.33 logic components, MTA 6 UI, and Apicurio Registry 2.

Exploitation context

The source bundle does not show KEV listing or active exploitation evidence. Exploitation requires high privileges and user interaction, but impact can be broad if a malicious realm admin or registration-capable client can target users in other realms or applications.

Researcher notes

Evidence supports a privileged XSS path through SAML ACS URL handling. Do not assume unauthenticated exploitability. The affected list includes several Red Hat packages, while some product entries are marked unaffected, so validate exact package and advisory mapping.

Mitigation direction

  • Review Red Hat advisories RHSA-2024:1353, 1867, 1868, 2945, and 4057.
  • Update affected Red Hat packages according to the applicable advisory.
  • Restrict SAML client registration permissions to trusted administrators only.
  • Review ACS POST Binding URLs for unsafe JavaScript URI schemes.
  • Check vendor guidance before applying product-specific compensating controls.

Validation and detection

  • Inventory Keycloak and Red Hat products against the affected package list.
  • Identify realms or clients with SAML client registration privileges.
  • Inspect SAML client ACS POST Binding URLs for unsafe URI schemes.
  • Confirm applicable RHSA fixes are installed in affected environments.
  • Verify no untrusted delegated administrators can alter SAML client registration.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-6717 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L0.55.5redhat

Vulnerability scoring details

Base CVSS 3.1 score

6Medium
CVSS 3.1 vector shape for CVE-2023-6717Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Reported to Red Hat.

  2. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorkeycloakkeycloak, 0, 24.0.0unaffected
Red HatRed Hat AMQ Broker 7keycloakunaffected
Red HatRed Hat build of Keycloak 22rhbk/keycloak-operator-bundle, 22.0.10-1affected
Red HatRed Hat build of Keycloak 22rhbk/keycloak-rhel9, 22-13affected
Red HatRed Hat build of Keycloak 22rhbk/keycloak-rhel9-operator, 22-16affected
Red HatRed Hat build of Keycloak 22.0.10keycloakunaffected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-data-index-ephemeral-rhel8, 1.33.0-5affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-data-index-postgresql-rhel8, 1.33.0-5affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-jobs-service-ephemeral-rhel8, 1.33.0-5affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-jobs-service-postgresql-rhel8, 1.33.0-5affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8, 1.33.0-5affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-operator-bundle, 1.33.0-5affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-rhel8-operator, 1.33.0-3affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-swf-builder-rhel8, 1.33.0-5affected
Red HatRHOSS-1.33-RHEL-8openshift-serverless-1/logic-swf-devmode-rhel8, 1.33.0-5affected
Red HatRHPAM 7.13.5 asyncSee advisoryunaffected
Red HatMigration Toolkit for Applications 6mta/mta-ui-rhel8affected
Red HatMigration Toolkit for Applications 7mta/mta-ui-rhel9unaffected
Red HatRed Hat build of Apicurio Registry 2keycloakaffected
Red HatRed Hat build of Quarkusorg.keycloak/keycloak-coreunaffected
Red HatRed Hat build of Quarkusorg.keycloak/keycloak-coreunaffected
Red HatRed Hat Data Grid 8keycloakaffected
Red HatRed Hat Decision Manager 7keycloakaffected
Red HatRed Hat Developer Hubrhdh-hub-containerunaffected
Red HatRed Hat Fuse 7keycloakaffected
Red HatRed Hat JBoss Data Grid 7keycloakaffected
Red HatRed Hat JBoss Enterprise Application Platform 6keycloakunknown
Red HatRed Hat JBoss Enterprise Application Platform 6org.keycloak-keycloak-parentunknown
Red HatRed Hat JBoss Enterprise Application Platform 6rh-sso7-keycloakunknown
Red HatRed Hat JBoss Enterprise Application Platform 7keycloakunaffected
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs