Executive brief
Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles
Affected products
- Maven org.keycloak:keycloak-parent
Junglewise Threat Intelligence
CVE-2022-2256: Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles
CVE-2022-2256 · Severity: low · CVSS 3.1 · Published 2022-09-23
Technologies: org.keycloak:keycloak-parent (Maven). Vendors: Maven.
Related threats
- Keycloak SSRF in client registration and backchannel notification URIs
- Keycloak permissive Authorization header parsing bypass
- Duplicate Advisory: Keycloak Open Redirect vulnerability
- Keycloak Cross-site Scripting on OpenID connect login service
- Keycloak vulnerable to path traversal via double URL encoding