description: It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
problem types: CWE-444
affected:
{
product: keycloak
vendor: Red Hat, Inc.
versions:
status: affected, version: 3.4.0
}