CVE-2022-2668

Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

7.2 HighFix available

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.00%Up 0.1 points since Aug 6, 2022

What each source reports

NVD Score used 7.2

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

Record: CVE-2022-2668
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

CVE List No score

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

Record: CVE-2022-2668
Updated: 2026-11-02

EUVDEUVD-2022-6962 No score

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

Record: EUVD-2022-6962
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wf7g-7h6h-678v 7.2

Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

Record: GHSA-wf7g-7h6h-678v
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-wf7g-7h6h-678v 7.2

Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

Record: GHSA-wf7g-7h6h-678v
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6782 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 7

Record: RHSA-2022:6782
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVRHSA-2022:6783 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 8

Record: RHSA-2022:6783
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7409 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7

Record: RHSA-2022:7409
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7410 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8

Record: RHSA-2022:7410
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7411 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9

Record: RHSA-2022:7411
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV No score

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

Record: CVE-2022-2668
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.keycloak:keycloak-parent` Maven	before 19.0.2	19.0.2
`org.keycloak:keycloak-parent` Maven	before 19.0.2, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less 1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final	19.0.2
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.5::el7 From an advisory covering 8 CVEs	before 0:15.0.8-1.redhat_00001.1.el7sso	0:15.0.8-1.redhat_00001.1.el7sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.5::el7 From an advisory covering 8 CVEs	before 0:15.0.8-1.redhat_00001.1.el7sso	0:15.0.8-1.redhat_00001.1.el7sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.5::el8 From an advisory covering 8 CVEs	before 0:15.0.8-1.redhat_00001.1.el8sso	0:15.0.8-1.redhat_00001.1.el8sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.5::el8 From an advisory covering 8 CVEs	before 0:15.0.8-1.redhat_00001.1.el8sso	0:15.0.8-1.redhat_00001.1.el8sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el7sso	0:18.0.3-1.redhat_00001.1.el7sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el7sso	0:18.0.3-1.redhat_00001.1.el7sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el8sso	0:18.0.3-1.redhat_00001.1.el8sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el8sso	0:18.0.3-1.redhat_00001.1.el8sso

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`rh-sso7` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:1-5.el9sso	0:1-5.el9sso
`rh-sso7-javapackages-filesystem` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:6.0.0-7.el9sso	0:6.0.0-7.el9sso
`rh-sso7-javapackages-tools` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:6.0.0-7.el9sso	0:6.0.0-7.el9sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el9sso	0:18.0.3-1.redhat_00001.1.el9sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:18.0.3-1.redhat_00001.1.el9sso	0:18.0.3-1.redhat_00001.1.el9sso
`rh-sso7-python3-javapackages` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:6.0.0-7.el9sso	0:6.0.0-7.el9sso
`rh-sso7-runtime` Red Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 11 CVEs	before 0:1-5.el9sso	0:1-5.el9sso

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2668 is a high vulnerability (CVSS 7.2) in Keycloak, published August 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in org.keycloak:keycloak-parent 19.0.2.

References

Show 65 moreShow less

This page doesn't list everything

Left out here: 90 versions. The JSON record has them.