GHSA-458h-wv48-fq75
Keycloak vulnerable to cross-site scripting via the state parameter
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-parent | <= 3.4.3.Final | no fix listed |
| Maven | org.keycloak:keycloak-parent | >= 4.0.0.Beta1, <= 4.0.0.Beta2 | no fix listed |
| Maven | org.keycloak:keycloak-parent | 4.3.0.Final | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using `response_mode=form_post` it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
References
External links from the advisory. They lead to third-party sites.