A flaw was found in keycloak. A keycloak adapter exposes internal endpoints in org.keycloak.constants.AdapterConstantsThe keycloak which can be invoked by appending the appropriate suffix (e.g. kversion) to any URL. This vulnerability might lead to an information exposure.

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks.

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.