Threats tagged 'ghsa-v3f7-2p4r-mwfw'

Keycloak versions prior to 26.6.4 contain a cross-site scripting (XSS) vulnerability that allows a remote attacker with administrative privileges and specific permissions to bypass client URI validation. This is done by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. The vulnerability enables arbitrary code execution in the Keycloak origin when a victim interacts with crafted links, such as during logout or in the Admin Console. A fix is available in version 26.6.4.