GHSA-458h-wv48-fq75MediumCVSS 5.4

Keycloak vulnerable to cross-site scripting via the state parameter

Published
May 13, 2022
Last Modified
October 19, 2023

🔗 CVE IDs covered (1)

CVE-2018-14655 →

📋 Description

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using response_mode=form_post it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

🎯 Affected products3

  • maven/org.keycloak:keycloak-parent:<= 3.4.3.Final
  • maven/org.keycloak:keycloak-parent:>= 4.0.0.Beta1, <= 4.0.0.Beta2
  • maven/org.keycloak:keycloak-parent:= 4.3.0.Final

🔗 References (6)