| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-core | < 1.1.0.Beta1 | 1.1.0.Beta1 |
If a JBoss Keycloak application was configured to use * as a permitted web origin in the Keycloak administrative console, crafted requests to the login-status-iframe.html endpoint could inject arbitrary Javascript into the generated HTML code via the "origin" query parameter, leading to a cross-site scripting (XSS) vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free