A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.keycloak:keycloak-server-spi-private(Maven) | 0 | 12.0.0 | N/A |
| org.keycloak:keycloak-services(Maven) | 0 | 12.0.0 | N/A |
CVSS Metrics
