Red Hat Single Sign-On 7.6.11 for RHEL 9, based on the Keycloak project, includes security fixes for two vulnerabilities: CVE-2024-8698, which involves improper verification of SAML responses potentially allowing privilege escalation, and CVE-2024-8883, which involves vulnerable redirect URI validation that can lead to open redirect attacks. These issues impact the authentication and redirect handling components of the SSO server. The update replaces version 7.6.10 and includes bug fixes and enhancements. Red Hat has rated the update as important and advises applying it following prior errata. No CVSS scores are provided in the advisory, and no known exploits have been reported.

The vulnerabilities could allow an attacker to escalate privileges by exploiting improper SAML response verification or to perform open redirect attacks due to insufficient validation of redirect URIs. These issues could undermine the security of authentication and session management in affected Red Hat Single Sign-On deployments. However, no known exploits in the wild have been reported, and Red Hat has released an update to remediate these vulnerabilities.

Red Hat has released Red Hat Single Sign-On 7.6.11 for RHEL 9 to address these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available in the Red Hat advisory and knowledge base. Since this is a standalone server product, remediation is the responsibility of the system administrator. There is no indication that no action is required or that the issues are already mitigated without updating.