CVE-2023-6134

MEDIUM4.6EPSS 2.5%

Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri

Published: 12/18/2023Modified: 2/16/2024

Description

Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References (13)