GHSA-484q-784p-8m5h
Cross-site Scripting in keycloak
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-server-spi-private | < 12.0.0 | 12.0.0 |
| Maven | org.keycloak:keycloak-services | < 12.0.0 | 12.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
References
External links from the advisory. They lead to third-party sites.