A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.
Affected Platforms
Redhat Enterprise LinuxRedhat Enterprise Linux For Power Little EndianRedhat Single Sign-OnRedhat Openshift Container PlatformRedhat Enterprise Linux For Ibm Z Systems EusRedhat Enterprise Linux For Power Little Endian EusRedhat KeycloakRedhat Enterprise Linux For Ibm Z Systems