title: Keycloak: reflected xss via wildcard in oidc redirect_uri
description: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
problem types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
product: keycloak-core
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat build of Keycloak 22
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhbk/keycloak-operator-bundle
defaultStatus: affected
versions:
version: 22.0.7-1, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:build_keycloak:22::el9
}
{
vendor: Red Hat
product: Red Hat build of Keycloak 22
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhbk/keycloak-rhel9
defaultStatus: affected
versions:
version: 22-6, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:build_keycloak:22::el9
}
{
vendor: Red Hat
product: Red Hat build of Keycloak 22
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhbk/keycloak-rhel9-operator
defaultStatus: affected
versions:
version: 22-9, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:build_keycloak:22::el9
}
{
vendor: Red Hat
product: Red Hat build of Keycloak 22.0.7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
cpe: cpe:/a:redhat:build_keycloak:22
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: keycloak-core
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.11-2.redhat_00003.1.el7sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.12-1.redhat_00001.1.el7sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.11-2.redhat_00003.1.el8sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.12-1.redhat_00001.1.el8sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.11-2.redhat_00003.1.el9sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.12-1.redhat_00001.1.el9sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions:
version: 7.6-38, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso7-rhel8-operator-bundle
defaultStatus: affected
versions:
version: 7.6.6-2, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions:
version: 7.6-41, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: Single Sign-On 7.6.6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: keycloak-core
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6.6
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]