← Database

CVE-2022-4361

CRITICAL CVSS: 10.0 Published: 2023-07-07 Modified: 2026-06-17

Description

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

Affected Platforms

Redhat Enterprise LinuxRedhat Single Sign-OnRedhat Openshift Container Platform For PowerRedhat Openshift Container PlatformRedhat Openshift Container Platform For Ibm LinuxoneRedhat Keycloak

Weakness Type

CWE-81, CWE-79

References