{"id":"GHSA-m98g-63qj-fp8j","aliases":[],"status":"published","title":"Reflected XSS on clients-registrations endpoint","description":"A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.\n\n### Acknowledgement\n\nKeycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-04-28T21:01:28Z","modified":"2024-11-28T05:40:56Z","fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-parent","fixed_in":["18.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"18.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"18.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.2","11.0.0","11.0.1","11.0.2","11.0.3","12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","13.0.0","13.0.1","14.0.0","15.0.0","15.0.1","15.0.2","15.1.0","15.1.1","16.0.0","16.1.0","16.1.1","17.0.0","17.0.1"]}],"references":[{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m98g-63qj-fp8j"},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-m98g-63qj-fp8j","title":"Reflected XSS on clients-registrations endpoint","description":"A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.\n\n### Acknowledgement\n\nKeycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.","status":"published","published":"2022-04-28T21:01:28Z","modified":"2023-01-07T05:00:40Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-m98g-63qj-fp8j","title":"Reflected XSS on clients-registrations endpoint","description":"A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.\n\n### Acknowledgement\n\nKeycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.","status":"published","published":"2022-04-28T21:01:28Z","modified":"2024-11-28T05:40:56.914808Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.463834Z"}]}}