| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-core | ≤ 16.1.0< 20.0.0 | 20.0.0 |
| single sign-on | = 7.0 |
A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (16.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the groups' dropdown functionality.
Successful attacks of this vulnerability can result a privileged attacker to load a XSS script, and steal data from other users. The impact can be considered moderate to low, considering privileged credentials are required.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free