What is GHSA-m98g-63qj-fp8j?

GHSA-m98g-63qj-fp8j is a security advisory published by GitHub Security Advisories with Medium severity. Reflected XSS on clients-registrations endpoint

Why does GHSA-m98g-63qj-fp8j have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-m98g-63qj-fp8j?

GHSA-m98g-63qj-fp8j affects 1 product, including: maven/org.keycloak:keycloak-parent:\u003e= 10.0.0, \u003c 18.0.0.

GHSA-m98g-63qj-fp8jMediumDisclosed before NVD

Reflected XSS on clients-registrations endpoint

Vendor

GitHub Security Advisories

Published

April 28, 2022

Last Modified

January 7, 2023

📋 Description

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.

Acknowledgement

Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.

🎯 Affected products1

maven/org.keycloak:keycloak-parent:>= 10.0.0, < 18.0.0

🔗 References (2)

https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
https://github.com/advisories/GHSA-m98g-63qj-fp8j