REDHAT-BUG-2548355: XSS
A stored cross-site scripting (XSS) vulnerability was discovered in Keycloak's login theme rendering. The vulnerability stems from a bypass in the kcSanitize filter. While kcSanitize correctly identifies and neutralizes certain numeric character references, a subsequent post-processing function, fixURLs(), restores the ampersand encoding. This restoration re-activates the malicious character references before they are parsed by the browser. An attacker with manage-realm permissions can exploit this by storing crafted HTML payloads in realm display fields like displayNameHtml or via localization overrides. Successful exploitation allows arbitrary JavaScript to execute in the context of any user loading the realm's login page. A specific variant on the WebAuthn error page allows for execution without any user interaction. An attacker could use this flaw to steal session tokens, perform actions on behalf of the user, or deface the login interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs manage-realm permissions in Keycloak. They can store a crafted HTML payload in realm display fields such as displayNameHtml or through localization overrides.
Which users are exposed to the malicious script?
Any user who loads the affected realm's login page can have arbitrary JavaScript executed in their browser context. The WebAuthn error-page variant can execute without user interaction.
What could an attacker do after successful exploitation?
The attacker could steal session tokens, perform actions as the affected user, or alter the login interface.