SAML HTTP-Redirect Binding Spoofing in Keycloak

Executive Summary

This vulnerability is in Keycloak's SAML protocol implementation when using HTTP-Redirect binding. If a client uses a wildcard redirect URL, an attacker can add malicious parameters to a SAML request. During authentication, Keycloak appends its legitimate response to these attacker-controlled parameters, causing some service providers to process the attacker's data instead of the real login information. This may lead to users being logged into incorrect accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Keycloak logs for SAML HTTP-Redirect binding requests with duplicate query parameters like SAMLResponse or RelayState. Check if clients use wildcard redirect URLs and if service providers parse only the first parameter occurrence. Monitor for unexpected session swaps or login CSRF attempts during authentication flows.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to redirect users to unintended accounts during SAML authentication. If exploited, a user might unknowingly log into an attacker-controlled account or service provider, potentially leading to unauthorized access to sensitive data or actions performed on behalf of the wrong user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling session swapping or login CSRF attacks. If an attacker forces a user into an attacker-controlled session, it may lead to unauthorized access to sensitive data, violating data protection requirements under GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Disable wildcard redirect URLs in Keycloak SAML client configurations. Review and restrict redirect URIs to specific trusted endpoints only.

Useful 0 Not Useful 0