Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Keycloak: Malicious Redirects Can Inject Code in Browser

published 2 years ago

Summary

Keycloak's redirect feature has a bug that can allow an attacker to inject malicious code in a user's browser, potentially leading to further attacks. This issue affects Keycloak users who rely on its redirect functionality. To protect your users, update Keycloak to the latest version or apply a patch from the vendor.

What to do

Update keycloak org.keycloak:keycloak-services to version 23.0.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	keycloak	org.keycloak:keycloak-services	< 23.0.3 Fix: upgrade to 23.0.3

Original advisory text

Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cvg2-7c3j-g36j. This link is maintained to preserve external references.

## Original Description
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.6 Medium

Type

CWE-75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Timeline

Published15 Dec 2023

Updated6 Mar 2026

First seen6 Mar 2026

Sources

GHSA-5968-qw33-h47j · GHSA

Track software like this

Free during beta