Description
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | keycloak | 3.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 2.5.14-1.Final_redhat_1.1.jbcs.el6 | RHSA-2017:2905, RHSA-2017:2904 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-parent | < 3.4.0 | 3.4.0 | GHSA-v38p-mqq3-m6v5 |
Advisories 2
- RHSA-2017:2904 Red Hat Security Advisory: rh-sso7-keycloak security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2905 Red Hat Security Advisory: rh-sso7-keycloak security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2017:2904 vendor-advisory
- RHSA-2017:2905 vendor-advisory
- RHSA-2017:2906 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1489161
- 101618 vdb-entry