Cross-site Scripting in Keycloak

MEDIUM 6.1CVE-2021-20323 · GHSA-xpgc-j48j-jwv9 · Published 25/03/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
org.keycloak:keycloak-core Maven	`≥ 15.0.0, < 17.0.0`	`17.0.0`
keycloak redhat	`< 17.0.0`	`17.0.0`

Description

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak version 15. The issue was fixed in version 17.0.0.

NVD description

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.