~ / search / GHSA-cvg2-7c3j-g36j

GHSA-cvg2-7c3j-g36j

Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-6134

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 23.0.3 23.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.

References

External links from the advisory. They lead to third-party sites.