Server side cross-site scripting In org.keycloak:keycloak-services
Description
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).
AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 21.1.2 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.