The vulnerability CVE-2024-8698 affects the SAML signature validation method in the Keycloak XMLSignatureUtil class. The method incorrectly uses the signature's position in the XML document to decide if the signature covers the entire document or only specific assertions, instead of relying on the Reference element that specifies the signed element. This logic flaw allows attackers to create specially crafted SAML responses that can bypass signature validation, enabling privilege escalation or impersonation attacks. Red Hat has issued security advisories and updated Red Hat Single Sign-On 7.6.11 packages for RHEL 7 and RHEL 8 to fix this issue.

Successful exploitation of this vulnerability can lead to privilege escalation or impersonation by bypassing SAML signature validation. This compromises the authentication and authorization mechanisms of affected Red Hat Single Sign-On deployments based on Keycloak, potentially allowing unauthorized access to protected resources.

Red Hat has released updated Red Hat Single Sign-On 7.6.11 packages for RHEL 7 and RHEL 8 that fix this vulnerability. Users should apply these official security updates to remediate the issue. Before applying the update, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's official advisories and update instructions for detailed guidance.