A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.keycloak:keycloak-parent(Maven) | 0 | N/A | N/A |
| org.keycloak:keycloak-parent(Maven) | 4.0.0.Beta1 | N/A | N/A |
| org.keycloak:keycloak-parent(Maven) | N/A | N/A | N/A |
CVSS Metrics
