GitHub Advisoryadvisory · Maven

GHSA-cvg2-7c3j-g36j Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri

MEDIUM Published 2023-12-18 Modified 2023-12-18 Official page ↗
Aliases
CVE-2023-6134
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-75
Reviewed
2023-12-18

Affected packages

• Maven org.keycloak:keycloak-services: < 23.0.3 → fixed in 23.0.3

Description

Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.

Related

Alias · CVE (1)

  • CVE-2023-6134 A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. vulnerability

Weakness · CWE (1)

  • CWE-75 Failure to Sanitize Special Elements into a Different Plane weakness

References