REDHAT-BUG-1625396: XSS
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using "responsemode=formpost" it is possible to inject arbitrary Javascript-Code via the "state"-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1625396?
The severity of REDHAT-BUG-1625396 is considered high due to the potential for XSS attacks.
How do I fix REDHAT-BUG-1625396?
Fix REDHAT-BUG-1625396 by upgrading to a patched version of Keycloak that resolves this vulnerability.
Which versions of Keycloak are affected by REDHAT-BUG-1625396?
Keycloak versions 3.4.3.Final, 4.0.0.Beta2, and 4.3.0.Final are impacted by REDHAT-BUG-1625396.
What is the risk associated with REDHAT-BUG-1625396?
The risk associated with REDHAT-BUG-1625396 is that an attacker can execute arbitrary JavaScript code through XSS after user login.
Where can I find more information about REDHAT-BUG-1625396?
More information about REDHAT-BUG-1625396 can be found in Red Hat's official security advisories.