GHSA-m98g-63qj-fp8j
Reflected XSS on clients-registrations endpoint
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.
Acknowledgement
Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.
What each source reports
GitHub AdvisoriesNo score
Reflected XSS on clients-registrations endpoint
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.
Acknowledgement
Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.
- Record
GHSA-m98g-63qj-fp8j- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Reflected XSS on clients-registrations endpoint
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.
Acknowledgement
Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.
- Record
GHSA-m98g-63qj-fp8j- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-parentMaven | 10.0.0 up to 18.0.0 | 18.0.0 |
org.keycloak:keycloak-parentMaven | 10.0.0 up to 18.0.0, plus listed versions 10.0.110.0.211.0.011.0.111.0.2 Show 19 moreShow less11.0.312.0.012.0.112.0.212.0.312.0.413.0.013.0.114.0.015.0.015.0.115.0.215.1.015.1.116.0.016.1.016.1.117.0.017.0.1 | 18.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-m98g-63qj-fp8j is a vulnerability with no CVSS score yet in org.keycloak:keycloak-parent, published April 28, 2022. No source lists public exploit code. Fixed in org.keycloak:keycloak-parent 18.0.0.