Red Hat Single Sign-On 7.6.11 is a security update for the standalone authentication server based on Keycloak. It fixes two vulnerabilities: CVE-2024-8698, which is an improper verification of SAML responses that can lead to privilege escalation, and CVE-2024-8883, which is a vulnerable redirect URI validation resulting in an open redirect. The update replaces version 7.6.10 and includes additional bug fixes and enhancements. The vendor rates the security impact as important and recommends applying the update after backing up existing configurations and data.

The improper verification of SAML responses (CVE-2024-8698) could allow an attacker to escalate privileges within the authentication system. The vulnerable redirect URI validation (CVE-2024-8883) could enable open redirect attacks, potentially facilitating phishing or redirecting users to malicious sites. Both vulnerabilities affect Red Hat Single Sign-On 7.6 prior to version 7.6.11. No known exploits in the wild have been reported, but the issues pose a significant risk to authentication integrity and user trust.

Red Hat has released version 7.6.11 of Red Hat Single Sign-On to address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying this official security update is the recommended remediation. There is no indication that these vulnerabilities are mitigated by default or require additional configuration changes beyond updating. Patch status is confirmed by the vendor advisory.