Description
A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | 18.0.8 – < 18.0.8 | 18.0.8 |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | keycloak-config-cli +2 | 6.4.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | <= 26.1.2 | — | GHSA-q4xq-445g-g6ch |
Advisories 1
- WID-SEC-2025-0424 Keycloak: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Apr 6, 2026
References
- https://access.redhat.com/security/cve/CVE-2024-4028 vdb-entry
- RHBZ#2276418 issue-tracking